Authentication

Creating an API key

1. Open the dashboard and navigate to the repository you want to create a key for.
2. Click API Keys, then Create an API key.
3. Give the key a descriptive display name — for example, GitHub Actions — and set the permission to read_write so the runner can submit results.
4. Optionally set an expiry (between 1 and 3,650 days). Keys with no expiry remain valid until revoked.
5. Copy the secret immediately — it is shown only once and cannot be recovered afterwards.

Key scopes and permissions

Each key has two settings that control what it can access:

• Scope — which repositories the key can act on. Keys can be scoped to all repositories on your account or to a specific list. For CI, scope the key to the single repository it will submit results for.
• Permission — read (fetch results only) or read_write (submit and fetch results). The runner needs read_write.

Using a key in GitHub Actions

Store the key as a repository secret named TESTQUORUM_API_KEY under Settings → Secrets and variables → Actions. Reference it in your workflow:

- name: Run tests via TestQuorum
  uses: testquorum/action@v0.1.0
  env:
    TESTQUORUM_API_KEY: ${{ secrets.TESTQUORUM_API_KEY }}

Rotating a key

From the dashboard, open API Keys and click Rotate next to the key you want to replace. A new secret is generated and the old one is invalidated immediately. Update your GitHub Actions secret before rotating to avoid any downtime.

Revoking a key

Click Delete next to any key to revoke it immediately. Any in-flight requests using that key will receive a 401 response. If a key is ever exposed, revoke it straight away and create a replacement.

Keys are never committed to source control — always use your CI system's secrets store.

Next steps