Skip to main content
FiveMesh V2 has two credential types. Keep both in server-side configuration. Keys belong to the resource owner’s customer account. A key created through organization collaboration also carries that organization context. You do not need an organization to create a personal key.

Server API Key

  1. Open Servers and select the registered server.
  2. Under Server API Key, click Generate API key.
  3. Copy the secret from the one-time dialog.
  4. Add it before your resource ensure lines:
The key identifies its server, so you do not need FIVEMESH_SERVER_ID. A Server API Key can upload to the owner’s CDN, but cannot list, delete or purge CDN objects. Use a Developer API Key for those actions or for restricted CDN path access.

Rotate or revoke a Server API Key

Open the server’s Server API Key panel and choose Rotate API key or Revoke API key. Review the confirmation. Rotation invalidates the previous key immediately. Replace it in every SDK or viewer configuration that uses it, then restart the affected resources. Revocation stops authenticated requests until a replacement key is configured.
The raw secret is shown only when generated or rotated. Keep it out of client Lua, NUI bundles and public repositories. If it is lost or exposed, rotate it.

Developer API Keys

Open Developers → API Keys (/developers/api-keys) in the dashboard and create a new key.
  1. Give it a descriptive name.
  2. Choose Global - all servers or Specific server.
  3. Choose all CDN paths or specific path prefixes when using CDN.
  4. Select a permission preset or customize the allowed actions.
  5. Review the scope and copy the secret immediately after creation.
Use the smallest permission set that supports your integration. The key cannot grant actions you do not have.

Global and server-specific scope

  • A specific-server key cannot query or ingest Logs for another server. The SDK resolves its cfx.re ID automatically.
  • A global key covers the resource owner’s servers. For SDK Logs features, set FIVEMESH_SERVER_ID to the server’s cfx.re join code.
  • CDN belongs to the customer account. A server binding alone does not isolate CDN folders; choose path prefixes to restrict media access.

CDN path prefixes

Restrict a key to the media paths its script uses, for example:
Keep uploads, lists and deletes inside the allowed prefixes. See CDN API permissions.

Permission areas

A dashboard permission does not imply that a public REST endpoint exists. Use the API reference for supported public routes.

Manage a Developer API Key

Use the key’s actions in Developers → API Keys to enable, disable or revoke it. Revocation is permanent. Create a replacement when the secret must change; the stored secret cannot be recovered. Deleting a registered server removes its bound credentials. Deleting an organization revokes organization credentials while preserving customer resources.