CronWarden

API keys

An API key lets scripts and infrastructure talk to CronWarden — to create and update monitors (the monitors API) and to read metrics (the Prometheus export). Keys are scoped to a team.

Creating a key

Create a key from your team's settings. CronWarden shows the full token once, at creation time — copy it then, because it can't be shown again. Only a hash of the token is stored, so no one, including CronWarden, can read it back later.

A token looks like:

cw_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

It's long and random by design (well over 200 bits of entropy), so it can't be guessed or brute-forced.

Using a key

Send the token as a Bearer credential on every API request:

curl -H "Authorization: Bearer cw_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  https://cronwarden.com/api/v1/monitors/nightly-backup

Any request whose token is missing, malformed, unknown, or revoked gets the same 401 response, with no hint about which — so a key can't be probed.

Keeping keys safe

  • Store the token in a secret manager or CI secret, never in source control.
  • Use separate keys for separate systems so you can revoke one without disrupting the others.
  • Revoke a key from settings the moment it might be exposed; revocation takes effect immediately.

Next

  • Monitors API — create and update monitors with your key.