Skip to main content
FiveMesh public API requests use bearer keys. Dashboard sessions are separate and cannot replace an API key.

Choose a key

Generate the Server API Key from Servers > the server overview. Create Developer API Keys from Developers → API Keys (/developers/api-keys). See API keys for creation and rotation. Keys resolve the resource owner’s customer account. Organization-scoped keys also depend on valid organization access.

Authorization header

For example:
Inspect the key to check its permissions and server binding.

Server scope

A server-bound key identifies the registered server automatically. For Logs requests with a global Developer key, name the cfx.re join code in the ingestion URL or query body. Requests for a different server than the key’s binding are refused. Dashboard server routes use FiveMesh’s registered-server ID; public Logs routes and the SDK’s FIVEMESH_SERVER_ID use the cfx.re join code.

CDN path scope

A server binding does not isolate CDN folders. Restrict a Developer key to allowed prefixes such as /phone or /screenshots when the integration should only manage those assets. The Server API Key has cdn:write, logs:read and logs:write. CDN reads, deletes and purge need a Developer key with the matching action.

Secret handling

Store keys in server ConVars, deployment secrets or server-only configuration.
Secrets are shown only at creation or rotation. Rotate a Server API Key or replace a Developer key if exposed in a client script, repository or browser bundle.
Scoped upload URLs are temporary credentials too. Keep their lifetime, path and upload limits narrow.