TachyonicAPI Authentication
Authentication methods for the Tachyonic API
API Keys
Create keys at platform.tachyonicai.com/settings.
curl -H "x-api-key: tach_live_..." https://api.tachyonic.sh/api/v1/scansKeys are scoped to a workspace. Available scopes:
| Scope | Description |
|---|---|
scan:read | List and view scans |
scan:write | Submit and cancel scans |
target:read | List and view targets |
target:write | Create targets |
target:manage | Update, delete, verify targets |
finding:read | List and view findings |
Device Flow (CLI)
The CLI uses OAuth device flow for interactive login:
tachyonic login- CLI requests a device code from the platform
- User opens a browser URL and approves
- CLI polls until approved, receives a JWT
- JWT is stored locally and refreshed automatically
Headless / CI
For non-interactive environments, use an API key:
tachyonic login --platform-api-key tach_live_...Session Auth (Dashboard)
The dashboard uses browser session authentication. No manual setup required — sign in at platform.tachyonicai.com.
Token Refresh
Device flow JWTs are automatically refreshed before expiry. If a token expires, run tachyonic login again.