Access keys

Let another service on your server read your apps, or change one app's sign-in, with a key that can only do what you allow.

On this page

Making a key
What a key can do
Using a key
Keeping track

An access key lets another program on your server, such as a separate admin panel or a monitor, ask LibrePortal about your apps without ever knowing your login. Each key has a name and a short list of things it is allowed to do, and you can switch it off at any time.

Only an Owner can make or revoke keys.

Making a key#

Go to Admin → Tools → Access and use the Access keys card, or run:

libreportal token create my-monitor --scopes apps:read,events:read

The key is shown once, in a copy box. Copy it then: LibrePortal keeps only a fingerprint of it and cannot show it again. If you lose it, revoke it and make a new one.

What a key can do#

You choose this when you make the key. It cannot be widened later; make a new key instead.

Scope	Lets the service
`apps:read`	See your apps, whether they are running, their addresses and how people sign in to them
`events:read`	Read the event log
`people:read`	See people, groups and who can reach which app (never passwords)
`system:read`	Read whether a restart or Docker update is waiting and the security status (read-only)
`apps:auth-write`	Change an app's sign-in source. Add `@forgejo` to limit it to one app

You can also set a key to expire after a number of days (--expires 30).

Using a key#

The service sends the key with each request:

curl -H "Authorization: Bearer <key>" http://<server>/api/v1/apps

The answer is the same JSON you get from libreportal app list --json, with the time it was made. Reading works from your own network, the VPN and your trusted places. Changing an app's sign-in works only from the server itself, the VPN, or over https. A key works only on this interface; it never opens the control panel.

Writing a tool that uses a key? See API keys and scopes in the developer pages.

Keeping track#

The Access keys card shows each key, when it was last used and from where. Every use is written to the activity log under the key's name. Revoke stops a key at once.

Next steps

Events and webhooksSee what LibrePortal did and have it tell another service at once.Security statusRead the server's security state, CrowdSec first, as one JSON document.Sign-in sourceChoose where each app's sign-in comes from: Authelia or its own.