Getting credentials

Print the metrics API URL and osk_ API key with openshield key, rotate a key, and understand how the console stores your secrets.

Last updated

On this page

The console authenticates to your agent with an API key. You get the key from the server itself — it is never generated or displayed in the dashboard.

On the server, run:

bash
openshield key

This prints the metrics API URL and the API key. Keys start with the osk_ prefix, which makes them easy to recognize in configs and logs. Paste both values into the Add server form in the console.

Rotate an API key

If a key leaks or you rotate secrets on a schedule:

  1. Rerun openshield key on the server to issue a fresh key.
  2. In the console, remove the existing server entry and add it again with the new key.

The console does not edit keys in place — remove and re-add is the supported flow.

How the console stores your key

The console stores API keys server-side. After you save a server, the browser never sees the key again: dashboard pages only receive proxied, permission-checked responses, so the secret stays off client machines entirely.

Next steps