The API authenticates with team API keys. A key belongs to a team and can do
anything the CI flow needs: upload builds, start runs, and read results for that
team’s projects.
Create a key
In the dashboard, go to Integrations → GitHub and create a key. It’s shown
once — copy it immediately. Only a hash is stored, so a lost key can’t be
recovered; revoke it and create a new one.
Keys look like:
Treat API keys like passwords. Store them as CI secrets, never commit them, and
revoke any key that may have leaked.
Use a key
Send it as a Bearer token on every request:
A missing key returns 401 missing API key; an unrecognized one returns
401 invalid API key.
Revoke a key
In Integrations → GitHub, click Revoke next to the key. Any pipeline still
using it starts failing immediately with a 401. 
