API and MCP
API keys — how to create and restrict
How to create an API key in the ZRAZU cabinet, choose its rights, domains, IP addresses and term, and revoke the key if it ends up in the wrong hands.
An API key is a password for a program. It allows only what you choose: specific actions on specific domains. A key is never stronger than the person who issued it, and it is checked on every call.
Keys are visible to the owner, administrators and technicians of the organization.
Create a key
- Open the cabinet → “Team” → “API keys”.
- Click “New key”.
- “Template” step: pick a ready set (“Read only”, “Monitoring”, “SSL certificates”, “DNS zones — for a manager”, “DNS zones — full access”) or “Custom set”.
- “Rights” step: change what exactly to allow, if needed.
- “Domains” step: “All domains of the organization, including future ones” or “Selected only” (up to 100 domains).
- “Conditions” step: name, whose key, allowed IP addresses, lifetime.
- “Summary” step: check what the key will be able to do and click “Confirm sign-in and issue”.
- Copy the key with the “Copy” button and store it in a password manager or your service's secrets. Click “I have copied the key”.
The key is shown once. We keep only its fingerprint and cannot show the key a second time. If you lose it, revoke it and issue a new one.
The key looks like zr_live_… followed by a long string. Never paste it into chats, emails or the code of web pages.
Rights
Rights are named “what.action”. The class shows the worst consequence: 0 — reading, 1 — reversible changes, 2 — money.
| Right | What it allows | Class |
|---|---|---|
domain.read | read domains, terms and locks — without contacts | 0 |
monitor.read | read the monitoring state | 0 |
monitor.edit | put domains under monitoring and take them off | 1 |
dns.read | read DNS zones and their records | 0 |
dns.edit | edit zone records and check delegation — with an email and a log entry | 1 |
dns.zone_create | add new zones — only a key for all zones | 1 |
keys.zones_grant | add and remove zones in other keys of the organization — rights and term stay unchanged | 1 |
ssl.read | read certificates and download their files | 0 |
ssl.reissue | reissue a certificate with a new key within the paid term | 1 |
ssl.order | order certificates from the organization balance | 2 |
billing.read | see the organization balance — without invoices and payments | 0 |
The dns.zone_create and keys.zones_grant rights work only for a key covering all domains and zones of the organization.
A key cannot do more than your role in the organization: if your role does not allow a right, it is unavailable in the cabinet.
What a key can never do
Register or renew domains, change contacts or locks, get a transfer code, revoke certificates. A key also cannot manage people and keys, payment methods, the second factor and sign-in email, or delete the account. These actions exist only in the cabinet.
Key conditions
- Name — for you, to tell the key apart in the list; up to 80 characters.
- Whose key. “Personal” stops working if you are removed from the organization. “Organization” — for CI and integrations, it outlives changes of people.
- Allowed IP addresses — one address or network (CIDR) per line, up to 20. The key will work only from them. For a key with the
ssl.orderright the list is required: such a key spends money. - Lifetime. Class 0: 365 days by default and at most. Class 1: 90 days by default, at most 365. Class 2 (money): 30 days by default, at most 90.
- “Changes only with my confirmation”. The key will propose a change as a plan, and you apply it in “Plans”. For SSL and DNS zones this option is not available yet.
A key that nobody has called for 90 days switches itself off: a forgotten key in an old repository is the most common source of leaks.
Revoke a key
- Open “Team” → “API keys”.
- In the key's row click “Revoke” and confirm: “Yes, revoke”.
The key stops working at once. If you suspect a leak and do not know which key, click “Revoke all”: every active key of the organization (for a technician — your personal ones) stops immediately. A sign-in confirmation is required.
Check that the key works
curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/api-keys/currentThe response shows the key's rights, domains, allowed IPs and term. For details on calls see the API overview.
If it didn't work
- No “API keys” item. Keys are visible to the owner, administrators and technicians. Ask the organization owner to change your role or to issue a key.
- A right is inactive and says “your role does not allow this”. A key cannot have a right your role lacks.
- The issue button asks to confirm sign-in. This is protection: issuing a key requires confirming your sign-in again.
- Too many keys. An organization can have up to 50 active keys and up to 20 new ones per day; revoke those you no longer need.
- The key returns `401 key_expired` or `key_idle`. The term is over or the key was not called for 90 days — issue a new one.