DocumentationAPI keys
API keys let an operator CLI or integration upload captures, start investigations, and read results without an interactive browser login. They are different from capture-probe credentials and from API keys used to connect PacketSafari to an AI provider.
Choose personal or team ownership
Use a personal API key for your own workstation or individual automation. Open Account → API keys.
Use a team API key for team-owned automation. Open My team → API keys. A team administrator creates and revokes these keys. The user who issued a team key must currently remain active in that team.
Create a separate key for each workstation or integration so you can revoke one without interrupting the others.
Create an API key
- Open Account → API keys, or open your team's API keys tab.
- Select Create API key.
- Enter a descriptive name, such as
SOC alert verification. - Choose an expiration period.
- Grant only the permissions the integration needs.
- Select Create API key, then copy the secret immediately.
The full secret is displayed once. PacketSafari later shows its prefix, owner, expiration, last use, and granted permissions, but cannot reveal the secret again.
The available permissions are:
| Permission | Use |
|---|---|
| Upload PCAPs | Upload a capture from the CLI or integration. |
| Read captures | Read capture metadata and processing state. |
| Submit alerts for verification | Start an alert-verification investigation. |
| Read verification results | Retrieve verification lifecycle and structured results. |
| Read reports | Retrieve the generated report. |
For the normal packetsafari investigate and packetsafari alert verify workflows, grant all five permissions. A narrower integration can omit permissions it never uses.
Configure the CLI
The key-ready dialog includes installation instructions and a copyable example. To save the key and deployment URL for later commands:
packetsafari config set server https://app.packetsafari.com
packetsafari config set api-key 'PASTE_YOUR_API_KEY_HERE'
packetsafari config show
Use your on-prem URL instead of https://app.packetsafari.com when applicable. config show redacts the saved secret. See Install and configure the CLI for environment variables, precedence, and model defaults.
Rotate or revoke a key
Create the replacement first, update the integration, confirm it works, and then select Revoke API key on the old key. Revocation is immediate and cannot be undone. Replace expired keys in the same way.
Do not paste a key into tickets, reports, or chat. Passing it with --api-key may save it in shell history; saved configuration or PACKETSAFARI_API_KEY is preferable for repeated use.
Credential types are separate
| Credential | Purpose | Where to manage it |
|---|---|---|
| Personal or team API key | Operator CLI and API submissions | Account or team API keys |
| Enrollment token | Registers a new capture probe | Capture → Capture probes → Probe credentials |
| Probe key | Authenticates an enrolled sensor | Capture → Capture probes → Probe credentials |
| AI-provider key | Lets PacketSafari call an upstream model provider | Account, team, or deployment AI settings |
Probe credentials cannot submit investigations. Operator API keys do not enroll probes. See Capture probes for sensor installation and credential handling.