Skip to main content
API keys are created automatically when you pair a machine with the CLI. You do not create keys from the dashboard — instead you run veil login on each machine that needs access, confirm the pairing in your browser, and the CLI stores a scoped key in the OS keychain.

​
Pairing a machine

Install the CLI and run:
The command prints a pairing code and opens your browser. Confirm the pairing in the Veil dashboard. When confirmed, the CLI stores a sandbox key and, if your account has completed live verification, a live key as well. Each paired machine appears in Settings → Paired Devices with its device name, active modes, and last-used timestamp.

​
Mode coverage

A paired device can hold up to two keys — one for sandbox and one for production. Sandbox is available as soon as you pair. Production requires completing the Go-Live flow first. The CLI picks the right key automatically based on the --mode flag or the active mode set with veil config set mode.

​
Revoking a device

To revoke a paired device, open Settings → Paired Devices, find the device, and click Revoke. This immediately invalidates every key associated with that device. The next API call from that machine will return an authentication error. The device can be re-paired at any time with veil login.

​
Headless and CI environments

On headless machines where a browser is unavailable, use --with-token to store a key directly without the browser flow:
Generate the key from a machine you have already paired, then pass it to the headless environment as a secret.

​
See also