Authentication

Nearly everything you can do in the console, you can do over the API. Requests authenticate with an API key passed as a bearer token.

Create an API key

Go to Settings → API keys and create a key. When you create it you choose:

Scope — read (safe for dashboards and monitoring; can't change anything) or full (can create, modify, and delete resources).
Expiry — optional, up to two years. Set one for keys you hand to CI or third parties, and rotate them regularly.

Copy it once

The key is shown only when you create it. Store it somewhere safe (a secrets manager, not your code). If you lose it, revoke it and issue a new one.

Make an authenticated request

Send the key in the Authorization header as a bearer token:

curl https://console.ekire.net/api/v1/instances \
  -H "Authorization: Bearer $EKIRE_API_KEY"

All endpoints live under /api/v1. Request and response bodies are JSON.

# Deploy a server
curl -X POST https://console.ekire.net/api/v1/instances \
  -H "Authorization: Bearer $EKIRE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "planId": "nano", "regionId": "<region-id>", "osImageId": "<image-id>", "name": "api-demo" }'

Scopes

Scope	Read resources	Create / modify / delete
`read`	✓	—
`full`	✓	✓

A read key that attempts a write is rejected with 403 Forbidden and the code read_only_key.

Scope isn't the only limit. A key of either scope is refused on the routes that add or remove a way to sign in — two-factor setup, passkeys, connected accounts — and on closing the account; those answer 403 with session_required, because a decision about how you sign in needs the person at the console, not a token sitting in CI. A key also acts only as its own owner, never as a team account you've been given access to.

While an account is suspended — including the zero-balance billing lock — every key on it stops resolving and answers 401 invalid_token, the same reply a wrong key gets. Add funds in the console to bring them back.

Keep keys secure

Never commit keys to source control or paste them into client-side code.
Give each integration its own key, so you can revoke one without disrupting the others.
Set expiries and rotate. Revoke immediately from Settings → API keys if a key may be exposed.

Explore the API

The API reference is generated from the live OpenAPI schema and lists every endpoint, field, and response — with a built-in client so you can try calls right in the browser.