Creating & Revoking API Keys

An API Key is the credential that authenticates machine-to-machine traffic between Circus and your workflow engine — in both directions: Circus calling the engine's webhook to start a run, and the engine (your n8n workflow) calling back into Circus to log steps, report completion, or terminate. These are separate from your operator login; they're for systems, not people.

Creating a key

You create a key by giving it a name. Circus generates the key and shows it in full exactly once, at creation time — copy it then, because the full value is never stored and can't be shown again. What Circus keeps is enough to manage and display the key (a name, short display fragments, an expiry, and an internal identifier used for revocation), but not the secret itself.

Expiry and revocation

Keys expire automatically after 30 days. You can also revoke a key at any time, with a confirmation step. Revocation takes effect immediately and cuts both directions: a revoked key can no longer trigger workflow runs, and workflows using it can no longer call back into Circus. There are no per-key permission scopes in this version — a key is simply valid or not.

Where keys are used

In practice, a key is configured on the workflow-engine side so your workflows can authenticate their callbacks, and it underpins the webhook traffic between the two systems. If a key is ever exposed, revoke it and issue a new one — because the full value is shown only once, rotation always means creating a fresh key rather than re-reading an old one.