API Keys

API keys authenticate requests to the compile API. Every pure build call and every WebSocket connection requires a valid key. Keys are scoped to an organization and count usage toward that organization’s billing.

Creating a key

1. Open the dashboard and navigate to API Keys.
2. Click New key.
3. Enter a display name (e.g. ci-prod, dev-laptop).
4. Click Create.

The key value is shown exactly once. Copy it now — it cannot be retrieved again. If you lose it, create a new key and revoke the old one.

Using a key

Pass the key as the api_key field in the first WebSocket message (compile.start). The CLI stores it in ~/.pure/credentials after the first successful compile.

Never commit an API key to version control. In CI, store it as a secret environment variable and pass it to the CLI:

PURE_API_KEY=pk_live_... pure build src/main.ts --release

The CLI reads PURE_API_KEY from the environment before prompting interactively.

Key status

Status	Description
Active	Key is valid and can authenticate requests
Expired	Key has passed its expiry date; creates an auth.error with code KEY_EXPIRED
Revoked	Key was manually revoked; creates an auth.error with code KEY_REVOKED

The dashboard shows the last time each key was used (last_used). Use this to spot unused keys that can safely be revoked.

Rotating a key

Rotating replaces a key value while keeping the same display name and settings. The old value immediately stops working.

1. Find the key in the API Keys list.
2. Click Rotate.
3. Copy the new value from the confirmation dialog.

Update any system that uses the old key before rotating.

Revoking a key

Revoking permanently deactivates a key. It cannot be un-revoked.

1. Find the key in the API Keys list.
2. Click Revoke → Confirm.

Subsequent requests using the revoked key return auth.error with code KEY_REVOKED.

Security practices

• Use one key per environment (dev, staging, prod, CI). This limits blast radius if a key is leaked.
• Set a short expiry on keys used in scripts that run on untrusted machines.
• Audit last_used periodically and revoke keys that have not been used in 90+ days.