API Keys

Overview

API keys authenticate the Arcanon Claude Code plugin, the bundled MCP server, and direct REST calls against Arcanon Hub. Each key is scoped to one org and has configurable permissions.

Creating a key

1. Go to Settings > API Keys
2. Click Create API key
3. Enter a name (e.g., "CI Pipeline", "Local dev")
4. Copy the key immediately — it's shown only once

Keys start with arc_ and are 43 characters long. Store them securely.

Using a key

Claude Code plugin

Inside Claude Code:

/arcanon:login arc_your_key_here

The key is persisted to ~/.arcanon/config.json (mode 0600). Subsequent /arcanon:sync and MCP calls use it automatically.

MCP Server

The plugin registers its MCP server automatically — if you've logged in via /arcanon:login, no extra config is needed. For standalone MCP clients (outside Claude Code), pass the key via environment variable:

{
  "mcpServers": {
    "arcanon": {
      "command": "/path/to/plugin/scripts/mcp-wrapper.sh",
      "env": {
        "ARCANON_API_KEY": "arc_your_key_here"
      }
    }
  }
}

Scan upload

Direct scan uploads (e.g., from CI) use the /api/v1/scans/upload endpoint:

curl -H "Authorization: Bearer arc_your_key_here" \
  -H "Content-Type: application/json" \
  --data @scan.json \
  https://api.arcanon.dev/api/v1/scans/upload

In day-to-day use, the plugin handles this for you — /arcanon:sync uploads the local graph built by /arcanon:map.

Arcanon's arc_* keys are scoped to two programmatic surfaces: scan upload and the plugin-bundled MCP server. The team dashboard at app.arcanon.dev uses its own browser login and does not accept arc_* keys.

Rotating a key

Click Rotate on an existing key. A new key is issued and the old one enters a 24-hour grace period — both work during this window. After 24 hours, the old key stops working.

Revoking a key

Click Delete on a key. It stops working immediately. Active scanner sessions using that key will fail on next upload.

Security

• Keys are stored as SHA-256 hashes — Hub never stores the plaintext
• Each key is scoped to one org via RLS — it cannot access other orgs' data
• Rate limits apply per key: 200 reads/min, 50 writes/min