API and machine access
Poweruser and temporary keys
An Autessa poweruser key lets scripts and integrations act as you against the Poweruser API, with the same resources, roles and company scope you have in the builder. Each person holds at most one permanent key, can mint any number of temporary keys that expire after 15 minutes, and can rotate or revoke instantly.
The problem
What problem does it solve?
Automation for CI, migrations and back-office jobs needs real management access. A long-lived admin credential is risky; one that expires in 15 minutes is far less so.
How it works
- 1
Generate
API Management → Poweruser Keys → Generate Poweruser Key, or Generate Temporary Key (15 min).
- 2
Copy once
“This is the only time you’ll see this key.” Store it in a secrets manager.
- 3
Use it
Pass it in the Authorization header of Poweruser API calls.
- 4
Rotate or revoke
Rotate Key invalidates the old secret immediately; Revoke Key ends it. Both need a confirmation checkbox.
Every option
Poweruser and temporary keys: settings and options
| Setting | What it does |
|---|---|
| Permanent key | pwrusr:{id}:{secret}. One active per person per company. |
| Temporary key | pwrusr_temp:{jwt}. Fixed 15-minute lifetime; as many as you need. |
| Delegated endpoint scoping | When a hosted custom app calls admin endpoints for its owner, it declares exactly which poweruser endpoints it may call. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Every member with API access | Manage their own keys only. |
| The key | Do exactly what its person can, nothing more. |
FOR DEVELOPERS
What to know
- Rotation is the right response to any suspected exposure; the old secret can never be recovered or re-enabled.
Connections
How Poweruser and temporary keys connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
Poweruser and temporary keys: questions
What is the difference between an API key and a poweruser key?
Client API keys run what you have published and are scoped per resource. Poweruser keys manage your workspace as you.
How long does a temporary key last?
Exactly 15 minutes. The lifetime is fixed.
Get started with Poweruser and temporary keys
A poweruser key lets automation act as you, with one permanent key per person, unlimited 15-minute temporary keys, and rotation that kills the old secret immediately.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours