Appearance
API and CLI Credentials
WebWorkstationadministrators manage integration credentials in Admin > Identity & Access > API & CLI. The page contains CLI Tokens, Publishable Keys, and API Keys.
Protect Private Credentials
API keys and CLI tokens are private credentials. Store them in your approved secret manager and never put them in a chat, ticket, source repository, or browser code. ZynoSuite displays an API-key secret only when it is created.
API keys
API keys authorize trusted server-to-server integrations for your organization. Create a key with a clear description and only the permissions the integration needs. A key is tied to your organization and cannot access another organization.
Use Edit to change its description or allowed permissions. Use Revoke to immediately disable a key you do not need or suspect is exposed. To replace a key, create and verify the replacement first, update the integration, and then revoke the key that is being replaced.
Publishable keys
Publishable zpk_ keys are browser-safe organization identifiers for approved public or embedded integrations. They are designed to appear in browser-delivered configuration, unlike API keys and CLI tokens. They do not replace a private credential for server-to-server work.
When you create or edit one, set the allowed website origins and enabled features that apply to the integration. An origin scope accepts the specific browser sites that can use the key; a feature scope limits the public capability the key identifies. Restrict both to the sites and features the integration needs whenever possible.
Use Revoke if the integration is retired or its key becomes exposed. Create a replacement key before removing a key that an active integration still uses.
CLI tokens
CLI tokens are personal, organization-specific credentials for authorized local command-line work. A token includes only permissions that its owner currently holds and can delegate. It cannot carry administrator impersonation, password-change, or fingerprint-management authority.
The local CLI opens a browser consent page when it needs a token. Select one of your direct organization memberships and confirm the requested permissions. ZynoSuite sends the token only to the local CLI listener. It never selects an MSP or impersonated organization for this flow.
An administrator can create their own token. A non-administrator can create or renew one only when the organization enables non-admin CLI tokens. The CLI Tokens tab controls that organization-wide non-administrator setting; it does not list individual grants. A CLI can revoke its own saved scoped grant through its sign-out command. For ZynoHosting, use zynohosting logout.
Common issues
| Problem | What to check |
|---|---|
| The API & CLI page is missing | Confirm that you are an organization administrator. |
| A secret is not available | Create a replacement and update the integration; ZynoSuite does not reveal an existing secret again. |
| CLI sign-in is denied | Confirm that you selected a direct organization membership and request only permissions you hold. Non-admin members also need the organization CLI-token setting enabled. |
| An integration stops after revocation | Create and configure a replacement credential before revoking a credential used by an active integration. |