API keys and permissions

Almanac API keys are workspace-scoped. Read-only is the default.

almanac keys create "Search service" --workspace acme

The full waka_... secret appears once. Store it in a secret manager. Later list output shows a separate API key ID and obfuscated value; deletion uses the API key ID.

Grant write access deliberately

almanac keys create "Wiki automation" --workspace acme --write

Permission	Allows
`almanac:wiki:read`	List, search, and read wikis, pages, sources, and jobs
`almanac:wikis:create`	Create wikis
`almanac:sources:upload`	Upload source files
`almanac:jobs:garden`	Start Garden jobs

--write grants all four permissions. For a narrower key, repeat --permission with only the required values.

Send the bearer token

HTTP
Python
CLI

curl "$ALMANAC_API_URL/v1/me" \
  -H "Authorization: Bearer $ALMANAC_TOKEN"

import os
from almanac import AlmanacClient

client = AlmanacClient(access_token=os.environ["ALMANAC_TOKEN"])

almanac --token "$ALMANAC_TOKEN" whoami

Do not put keys in committed files, command examples with real secrets, client-side browser code, or screenshots. See Configuration for the supported environment variables.

​Grant write access deliberately

​Send the bearer token

Grant write access deliberately

Send the bearer token