Create an API Key

An API key lets a script, a CI job, or a Certora Prover client work for your organization without your password. This guide shows you how to create a key on the API page, store it, test it, and revoke it.

Before you start

• You must be a verified member of the organization. Any role can create a key.
• On a Free plan, a key can only use Certora Prover. The Runs API, which starts AI Auditor, AutoProver, and AutoFuzzer runs, needs a Pro or Enterprise plan.
• An organization can have 50 active keys at most.
• An organization can create 10 keys per hour at most.

Open the API page

1. Sign in to app.certora.com.
2. At the top of the sidebar, select the organization that will own the key.
3. In the sidebar, select API.

The API Access page opens. The API Keys card shows the active keys of the organization.

Create the key

1. Select Generate Key. The Generate New API Key dialog opens.
2. In Name, type a name that says where you will use the key, for example CI pipeline.
3. Under Expiration, select how long the key stays valid. Select Custom to type a number of days from 1 to 365.
4. Under Permissions, clear each permission that the key does not need.
5. Select Generate Key.

All permissions are selected when the dialog opens. You cannot change the permissions after you create the key, so give the key only what its job needs.

Copy and store the key

The API Key Generated dialog shows the full key. The app shows the full key only one time.

1. Select the copy icon at the right of the key.
2. Paste the key into a password manager or a secrets store.
3. Select Done — I've saved my key.

If you close the dialog before you copy the key, you cannot get the key back. Revoke that key and create a new one.

Do not put a key in a repository, in browser code, in logs, or in a request body. Anyone who has the key can start runs that your organization pays for.

Make sure that the key works

The new key is in the API Keys table with the status Active. The table shows only the start of the key. Hold the pointer on the number in the Permissions column to see the permissions of the key.

On a plan with Runs API access, send the key to GET /v2/access from a terminal. Replace <your-key> with the full key.

export CERTORA_API_KEY="<your-key>"

curl --fail-with-body \
  -H "Authorization: Bearer $CERTORA_API_KEY" \
  "https://app.certora.com/v2/access"

A key that works returns a JSON response that lists its scopes and the run types that your organization can start. After the request, the Last Used column in the table shows a time.

The REST API Reference describes every endpoint. The Certora Prover guide describes how to use a key with a Prover client.

Revoke a key

Revoke a key when you stop using it, or immediately if someone else saw it. Any member of the organization can revoke any key.

1. In the API Keys table, find the row of the key.
2. Select the trash icon in the Actions column.
3. In the Revoke API Key dialog, select Revoke.

You cannot undo this step. Each request that uses a revoked key fails. Before you revoke a key that is in use, create a new key and put it in your integration.

Replace an expired key

An expired key shows the status Expired and a rotate icon in the Actions column.

1. Select the rotate icon. The dialog opens with the same name.
2. Create the new key and store it.
3. Put the new key in your integration.
4. Revoke the expired key.

Troubleshooting

The sidebar does not show API

An administrator turned off API access. Open Support and select Talk to a human.

The page asks me to upgrade

The Runs API needs a Pro or Enterprise plan. An organization owner can change the plan in Settings, then Billing. On a Free plan, you can still use the API Keys card above the message. A key from a Free plan works with Certora Prover only.

"Too many API keys created recently"

Your organization created 10 keys in the last hour. The message shows the time when you can create the next key.

"This organization has reached the maximum of 50 active API keys"

Revoke a key that you do not use, then create the new key.

A key stopped working

A key stops working in each of these cases:

• The key expired.
• Someone revoked the key.
• The member who created the key left the organization, was banned, or deleted the account.

Before you remove a member, create new keys under a different member and put them in your integrations.