Authentication
Two values, set once: the id of the app being scanned, and the key it is scanned with.
There is no account to sign in to and no session to keep alive. A scan needs an app id, naming what is being scanned, and an app key, naming who is scanning it. Set both and every command works — on a laptop, in CI, and inside an agent, identically.
Set both values
Create a key under Developer Settings, then API keys, and export it alongside the id of the app it scans. Both are picked up automatically.
$ export SENTRASEC_APP_ID=app_...$ export SENTRASEC_APP_KEY=sk_prod_...Or pass them per command, which is what makes one shell able to work across several apps without re-exporting anything:
$ sentrasec scan --app-id app_... --app-key sk_prod_...The label you give the key is recorded against every scan it runs, so name it after the job that will use it — ci-github-actions, nightly-scan, claude-code. That label is what distinguishes a CI run from a developer's laptop when someone reads the scan history months later.
Store the key as a secret in your CI provider. Never commit it to a repository, and rotate it if it is ever exposed.
Verify
$ sentrasec scan listLists the app's scan history. An empty list with no credentials error means the pair works; a credentials error means the app id or app key still needs fixing.
What a key looks like
Keys are issued per workspace and carry the environment they belong to:
| Prefix | Environment |
|---|---|
sk_prod_... | Production workspace |
sk_test_... | Test workspace |
The full value is shown once, when the key is created, and cannot be retrieved afterwards. If you lose it, create a new key and delete the old one.
Resolution order
The key is resolved in this order, first match winning. Explicit beats ambient, so a CI job that passes --app-key is unaffected by whatever happens to be exported in the environment it runs in.
| Source | Notes |
|---|---|
--app-key | Command-line flag. Highest priority. |
SENTRASEC_APP_KEY | Environment variable. What CI should use. |
SENTRASEC_API_KEY | The older name for the same thing. Still read, for compatibility. |
~/.sentrasec/credentials | A key stored on this machine. Lowest priority. |
The app id resolves the same way: --app-id, then SENTRASEC_APP_ID, then the credentials file.
Storing a key on one machine
On a personal machine you can keep a key on disk instead of exporting it into every shell. sentrasec login --api-key sk_prod_... writes it to ~/.sentrasec/credentials with owner-only permissions, and every later command reads it from there.
This is a convenience, not a separate way in: the file holds the same app key, and it is the last place the CLI looks. Do not use it in CI, where a secret store and SENTRASEC_APP_KEY are the right answer, and where a key left in a home directory outlives the job that needed it.