Get an API key

Create an account

Sign up

Open /dashboard/signup.html. Enter your email, password, and organization name.

Your password must contain at least 10 characters.

Pantheon Create an account form in the dark theme — Create an account with your email, password, and organization name.

Sign in

Use /dashboard/index.html when you return. Pantheon opens the keys page after sign in.

Create a key

Enter a name on the keys page. Pantheon uses the full tenant builder scopes by default.

Pantheon keys page showing a newly created one time secret — Create the key to reveal its secret one time.

Copy the secret

Copy the secret immediately. Pantheon shows it once and stores only its hash.

Pantheon keys page confirming the secret was copied to the clipboard — Copy the secret and keep it in a secure location.

Use the key

Set the production base URL and the one-time secret.

Terminal

export PANTHEON_BASE_URL="https://pantheon-todo.alethiconsulting.com/pantheon-api"
export PANTHEON_API_KEY="PANTHEON_API_KEY"

Send the key as a bearer token. API keys cannot list, create, or revoke other keys.

Manage keys

The keys page lists each key without its secret.

Pantheon keys page listing a key without its secret — Review key details without exposing the secret.

Action	Result
Create	Pantheon shows the new secret once.
Review	You see the name, prefix, scopes, creation time, last use, and revocation state.
Revoke	The key stops working and returns `KEY_REVOKED`.

Revoke a key from the same page. Create a replacement before revoking an active key.

Auth release routes

Method	Path	Use
`POST`	`/v1/auth/signup`	Create a user, tenant, and session.
`POST`	`/v1/auth/login`	Start a session.
`POST`	`/v1/auth/logout`	Revoke the current session.
`GET`	`/v1/auth/me`	Read the current user, tenant, and session expiry.
`GET`	`/v1/auth/keys`	List keys without secrets.
`POST`	`/v1/auth/keys`	Create a key and return its secret once.
`DELETE`	`/v1/auth/keys/{id}`	Revoke a key.
`POST`	`/v1/auth/password/change`	Change the signed-in user's password.

Signup response

Send email, password, and organization_name. A successful request returns HTTP 201.

Selected JSON

{
  "user": {"id": "user_123", "email": "you@example.com"},
  "tenant": {"id": "tenant_123", "name": "Acme", "slug": "acme"},
  "session": {"token": "ps_SESSION_TOKEN", "expires_at": "2026-10-04T12:00:00Z"}
}

Key response

Send name and optional scopes. A successful request returns HTTP 201.

Selected JSON

{
  "id": "key_123",
  "name": "Development",
  "prefix": "pk_example",
  "scopes": ["..."],
  "created_at": "2026-09-04T12:00:00Z",
  "secret": "PANTHEON_API_KEY"
}

Limits and sessions

Value	Meaning
5 signups per IP per hour	Further signup requests wait until the rate window resets.
10 login attempts per email per 15 minutes	Further attempts return HTTP 429 with `retry_after`.
30 day session expiry	Valid session use extends the expiry.
`ps_` prefix	Identifies an opaque session token.

The dashboard stores the session token in localStorage under pantheon.session.

Manage your application

Create and edit agents, publish deployments, and review deployment history on the dashboard Agents page.

Filter sessions, inspect usage and events, and archive sessions on the dashboard Sessions page.

Reset a password

Change a known password from the account page.

Email delivery is not available yet. An admin resets a forgotten password with POST /v1/admin/users/{id}/password.

Pitfalls

The secret is missing from the key list: This is expected. Pantheon returns the secret only when you create the key.
Sign in returns INVALID_CREDENTIALS: Check both fields. INVALID_CREDENTIALS does not identify which value is wrong.
Sign in returns RATE_LIMITED: Wait for the retry_after interval after RATE_LIMITED.
You forgot your password: Ask an administrator to reset it. Email reset is not available yet.