Authentication & API keys

API keys, the Authorization header, and how access is scoped.

Every surface — REST, CLI, MCP — authenticates with a long-lived API key.

Creating a key

Keys are created in the TestVibe app under Settings → CLI & API keys. A key looks like:

tvb_9hK2mPqRsT4uVwXyZ1aB3cD5eF7gH8jL0nQ6rS2tU4v

• The tvb_ prefix plus 43 base62 characters.

• The full key is shown exactly once, at creation. Only a hash is stored server-side; if you lose the key, revoke it and create a new one.

• The Settings panel shows each key's display prefix (tvb_XXXXXXXX), creation date, and last-used time.

Using a key

Send it as a bearer token on every request:

curl -H "Authorization: Bearer $TESTVIBE_API_KEY" \
  "$TESTVIBE_SERVER/api/v1/ops/projects"

The CLI and MCP server read it from testvibe login, the TESTVIBE_API_KEY environment variable, or per-repo config — see The testvibe CLI.

What a key can do

A key acts as the user who created it, inside the workspace it was created in:

• It can see and operate on every project of that workspace (subject to the creator's access).

• It stops working immediately if it is revoked, or if the creating user leaves the workspace.

Failure mode

Requests without a valid key get 401:

{
  "error": "unauthorized",
  "message": "A valid API key is required (Authorization: Bearer tvb_…)."
}

Key hygiene. Put keys in environment variables or secret stores, never in committed files. Create one key per machine or integration so you can revoke them independently.