API Keys

API keys authenticate requests to the compile API. Every pure build call and every WebSocket connection requires a valid key. Keys are scoped to an organization and count usage toward that organization’s billing.

Creating a key

The easiest way to get a key for your own local use is pure login — see CLI → Log in. It opens your browser, signs you in, and mints a personal key automatically; no dashboard steps needed.

To create a key by hand instead (for a service account, a named CI key, or anything you want to manage/name/scope explicitly from the dashboard):

1. Open the dashboard and navigate to API Keys.
2. Click New key.
3. Enter a display name (e.g. ci-prod, dev-laptop).
4. Click Create.

The key value is shown exactly once. Copy it now — it cannot be retrieved again. If you lose it, create a new key and revoke the old one.

Using a key

Pass the key as the api_key field in the first WebSocket message (compile.start). pure login stores it for you — in your OS keychain, or ~/.config/pure/credentials (mode 0600) when no keychain is available — so every later CLI command picks it up automatically without prompting.

Never commit an API key to version control. In CI, store it as a secret environment variable and pass it to the CLI:

PURE_API_KEY=pk_live_... pure build src/main.ts

The CLI reads PURE_API_KEY from the environment before falling back to a stored/logged-in key, and never prompts interactively when a key is available from a flag, environment variable, or pure login.

Running in GitLab CI? You can skip storing a key entirely — see GitLab CI Integration.

Key status

Status	Description
Active	Key is valid and can authenticate requests
Expired	Key has passed its expiry date; creates an auth.error with code KEY_EXPIRED
Revoked	Key was manually revoked; creates an auth.error with code KEY_REVOKED

The dashboard shows the last time each key was used (last_used). Use this to spot unused keys that can safely be revoked.

Rotating a key

Rotating replaces a key value while keeping the same display name and settings. The old value immediately stops working.

1. Find the key in the API Keys list.
2. Click Rotate.
3. Copy the new value from the confirmation dialog.

Update any system that uses the old key before rotating.

Revoking a key

Revoking permanently deactivates a key. It cannot be un-revoked.

1. Find the key in the API Keys list.
2. Click Revoke → Confirm.

Subsequent requests using the revoked key return auth.error with code KEY_REVOKED.

Security practices

• Use one key per environment (dev, staging, prod, CI). This limits blast radius if a key is leaked.
• Set a short expiry on keys used in scripts that run on untrusted machines.
• Audit last_used periodically and revoke keys that have not been used in 90+ days.