API keys: permissions, IP restrictions and expiry
In this article (7)
API keys allow some actions through tools without signing in to the dashboard. TeknoWeb customer keys are used as deploy keys in the MCP configuration of AI coding tools such as Claude Code, Codex or Gemini. Manage them on API keys.
Permissions
Each key can perform only selected actions; no wildcard permission grants everything. Select at least one permission.
| Permission | Purpose |
|---|---|
deploy | Upload and publish the site |
status | View site/order status and disk usage |
logs | Read site error logs |
set_env | Set environment variables (.env) |
Select only necessary permissions. A log-reading tool needs only logs.
Creating a key
- API keys: give the key a distinctive name.
- Select permissions.
- Optionally specify allowed IP addresses and expiry.
- Create key.
- The key is shown only once. Copy it immediately and store it securely; it cannot be viewed again. If lost, delete it and create another.
Restrictions
Allowed IP addresses
To restrict access, enter one IP address or CIDR range (IPv4 or IPv6) per line, up to 20 entries. Leaving it blank allows use from any address.
Validity period
Set an expiration date to disable the key automatically afterwards, up to 730 days ahead. The dashboard offers presets and no-expiry options.
Hourly request limit
Each key has an hourly request limit shown in the list. Exceeding it rejects requests for that hour with 429 (too many requests).
Security recommendations
- Do not add keys to repositories or public locations.
- Delete unused keys.
- Update restrictions later through edit restrictions.
Removing a team member also disables their API keys; see Team members and roles.