Skip to main content
All requests to interact with the Validio platform through the API require authorization with an API key. An API key consists of an access key and an access secret. To create one, see Managing API keys.
CautionThe API key credentials cannot be obtained again. If you lose your credentials, you must either create a new API key or regenerate the credentials for your existing API key.

​
Authorize API requests

To authenticate your requests to the GraphQL API, pass the Authorization header. The header value has the format <access-key>:<access-secret>.
You can use environment variables to avoid storing credentials on disk. The variables to set are VALIDIO_ENDPOINT, VALIDIO_ACCESS_KEY, and VALIDIO_SECRET_ACCESS_KEY.

​
How the CLI and SDK find credentials

The Validio SDK, and the CLI that wraps it, look for credentials in the following order:
  1. The environment variables VALIDIO_ENDPOINT, VALIDIO_ACCESS_KEY, and VALIDIO_SECRET_ACCESS_KEY.
  2. A config.json in the path set by VALIDIO_CONFIG_PATH.
  3. A config.json in an OS-specific path defined by platformdirs.
You can create the config.json with the Validio CLI by running validio config init. See Configure default API credentials. When using the SDK, you can also pass the credentials directly to the client without storing them on your disk. See Validio SDK.

​
API keys and namespaces

An API key has a global role, similar to the global role for users, that determines access rights for non-namespaced resources such as users, namespaces, and tags. For how API keys gain access to namespaces, see API keys and namespaces.