API Tokens and SSH Keys
Machine access with least-privilege credentials.
Two kinds of machine credential exist: API tokens for everything that talks HTTP (CLI, MCP, CI webhooks, scripts), and SSH keys for Git providers and node provisioning.
API tokens#
Under Settings → Security, create a token with a zs_ prefix, an
optional expiry, and last-used tracking. Tokens are the credentials for:
- the CLI (
zensailor login), - the MCP server (configured in the MCP setup),
- the HTTP API (
Authorization: Bearer zs_...), - CI redeploys via webhook tokens (service-scoped — see Webhooks and CI/CD).
Revoke a token the moment you suspect it leaked; revocations are immediate.
BASH
zensailor config apikey list
zensailor config apikey create --name ci
zensailor config apikey revoke <token-id>SSH keys#
SSH keys authenticate two different workflows:
- Custom Git (SSH) sources — connect to GitLab, Gitea, Bitbucket or a self-hosted Git server by adding your key to the platform, then to the provider.
- Node provisioning — the control plane pushes the agent to new nodes over SSH.
Private keys are encrypted at rest with AES-256 using the platform master key.
BASH
zensailor ssh-key list
zensailor ssh-key add --name gitlab --key "$(cat ~/.ssh/id_ed25519.pub)"
zensailor ssh-key generate
zensailor ssh-key rm <key-id>