Preview: API Key management
Let's talk API, tokens, and everything in between. Until today, the Atera API worked one way: your account had a single key, and that key did everything. The reporting script, the billing sync, the contractor's one-off integration, the thing someone built two years ago that nobody fully remembers, all authenticating with the same credential, all carrying full read-write-delete access to your contacts, devices, customers, and tickets.
That worked, sure. It also meant two things were true at once. Blast radius was account-wide. A single key that leaked, or got handed to someone who shouldn't keep it, exposed everything. There was no “this integration can only read tickets” version of it. It read, wrote, and deleted across the whole account.
And rotation was all-or-nothing. Resetting the key broke every integration using it at the same moment. So most people didn't rotate. They left a years-old key in place because the cleanup was worse than the perceived risk. API tokens change both of those.
What changed
The difference from one key: what each token is allowed to do. When you create a token, you grant access per resource and per action: Agents, Alerts, Tickets, Contacts, Customers, Billing, Contracts, Custom Values, Devices, Knowledge Base, Rates, each with independent Read, Write, and Delete.
That said, a reporting integration that only reads tickets and agents gets a token scoped to exactly that: Tickets Read, Agents Read, nothing else. It cannot touch Customers. It cannot delete anything. The token carries the access the integration uses and none of the access it doesn't.
Three more controls to complement it:
- IP restriction. Leave a token open to any IP, or lock it to specific addresses so it only works from the server or service that's supposed to use it. A token scoped to two read endpoints and locked to one IP is a very small thing to lose if it ever leaks.
- Expiration. Every token now has a visible and configurable expiration date. Tokens are not forever by default, which is a posture shift from a key that never aged out.
- Statuses: Active, Revoked, or Expired, visible at a glance in the list.
