Projects & API keys

A project is the unit that owns an enforcement policy, telemetry, and an API key once one is generated. Classifier calls and gateway requests are attributed to a project, and the dashboard slices analytics and traces by project.

Projects#

Projects can be repo-backed or manual:

• GitHub Repository. Repo-backed. Connects PR context, project memory, policy overrides, and traces to the same GitHub repository.
• Manual. Useful for standalone SDK checks and gateway traffic from applications, Codex, Claude Code, or another redirectable client. A manual project is creator-owned and does not automatically attach saved project memory to pull requests.

Create a project#

1. Open the dashboard and go to Projects.
2. Click Create Project, choose GitHub Repository or Manual, and give it a name (for example fraud-detection-prod).
3. The API key is shown once after this creation flow. Copy it immediately, as described below. The project setup card then offers SDK initialization plus copyable Codex and Claude Code gateway configuration.

Connecting a GitHub installation only authorizes repositories; it does not create projects or enroll repositories in Secure Agents. Create a repository-backed Integrity project from the Projects page. Secure Agents repositories are selected independently from the Repositories page.

API keys#

Project keys are prefixed tsk_ followed by 64 hex characters. Integrity stores only a SHA-256 hash of the key plus a short prefix (tsk_ + 4 characters, shown in the dashboard as tsk_xxxx…) so it can identify the project without ever holding the raw secret.

The same key authenticates both the REST classifier endpoints and the gateway, though they read it from different headers, which is covered on those pages.

Scope what you instrument#

A project key does not force you to ingest a whole repository or proxy a whole application. The SDK is call-site scoped. You decide where to call it: one route, agent, tool runner, workflow, package, or subsystem. Use session_id / sessionId to encode reporting scope, for example repo:payments-service:agent:security-review:run_123.

The gateway has the same shape. Route only selected OpenAI, Anthropic, or agent clients through the proxy unless you want global coverage. Leave other model calls untouched. A managed agent that does not expose a model base-URL override cannot use this insertion point, and out-of-band tools remain governed by their own identity and network controls.

Rotating a key#

In a project’s detail panel, use Regenerate. This replaces the stored hash, and the previous raw key cannot be recovered. Deploy the new key before regenerating in production. The gateway normally refreshes cached authentication within about 15 seconds and can continue accepting a previously cached key for up to 30 minutes during a database outage. Direct REST and SDK checks normally refresh their authentication snapshot within five minutes; if refreshes fail, the last successful snapshot has no time-based expiry. Rotation is therefore not an immediate revocation control. See Config cache during outages.

Using the key#

Keep keys in environment variables, never in source control. The SDKs read them at init:

export TRIAGE_API_KEY="tsk_..."

import os
import triage_sdk

triage_sdk.init(api_key=os.environ["TRIAGE_API_KEY"])

Gateway clients also need their own provider credential. The Integrity key identifies the project; it is not an OpenAI or Anthropic key and is never a substitute for provider authentication. See Codex and Claude Code for the exact environment and user-config mapping.