API keys for CLI automation

Use a scoped API key for CI, cron, containers, and other unattended CLI workloads. Keep human browser sessions separate from machine credentials.

Create a least-privilege key

Create and manage keys directly from the CLI (this requires an interactive browser session, so run champrep auth login first — API keys cannot manage other API keys). The secret is printed once, so capture it immediately.

champrep keys create --name "nightly-export" --scope drive:read
champrep keys ls

You can also open API Keys in the dashboard.

Examples:

• A nightly Drive export normally needs drive:read, not write or delete.
• A calendar publisher can use calendar:write without Mail or Work access.
• A script that sends mail needs mail:send; add mail:read only if it also reads accounts, messages, or threads.

The active plan, profile, organization policy, role, and service-specific limits still apply after the scope check.

Store a key in the OS keychain

champrep auth token

The command prompts securely and stores the key in the operating-system keychain. It does not write the token to the CLI configuration file.

Verify the result:

champrep auth whoami
champrep auth status

Inject a key into CI

Store the key as a masked, protected CI secret named CHAMPREP_TOKEN. The CLI uses that environment variable as an ephemeral override and bypasses the local keychain.

champrep auth whoami --json
champrep drive quota --json

Do not print the variable, enable shell command tracing around it, or pass it as a command-line argument. Restrict the secret to the branches and environments that need it.

Rotate without an outage

1. Regenerate the secret (champrep keys regenerate KEY_ID) or create a replacement key with the same necessary scopes (champrep keys create).
2. Update the secret manager or CI variable.
3. Run a harmless identity or read command with the new key.
4. Confirm the production workload has adopted it.
5. Revoke the previous key (champrep keys revoke KEY_ID).

Immediately revoke a key that may have been exposed. Treat a 401 from a revoked key as terminal rather than retrying forever.

Review access

List keys and inspect a key’s recent activity from the CLI:

champrep keys ls
champrep keys get KEY_ID
champrep keys audit KEY_ID

Periodically check:

• whether the workload still exists;
• whether every selected scope is still required;
• whether IP restrictions can be narrowed;
• whether activity and last-used information match the workload;
• whether the key has a named owner and rotation schedule.

For the complete scope catalog and direct API use, see authentication and API keys.