VB-OS API Keys for CI/CD Pipelines

Create an API Key

API keys are scoped to a specific environment:

from vbos import VBOSClient

client = VBOSClient(api_key="YOUR_API_KEY")

key = client.keys.create(
    project_id="PROJECT_ID",
    environment_id="ENVIRONMENT_ID",
    name="ci-pipeline-key",
    scopes=["verify"],
)

print(key["key"])  # Store this securely -- it is shown only once

The key value is returned only at creation time. Store it in your CI/CD system’s secret management (e.g., GitHub Secrets, Vault).

Use in CI/CD

Add a verification step to your pipeline:

# GitHub Actions example
- name: Verify deployment readiness
  env:
    VBOS_API_KEY: ${{ secrets.VBOS_API_KEY }}
  run: |
    vbos verify \
      --project my-project \
      --boundary deployment-readiness \
      --evidence '{
        "test_pass_count": 142,
        "test_fail_count": 0,
        "coverage_percent_bp": 8500,
        "security_scan_passed": 1
      }'

Environment Scoping

The API key determines which environment’s boundary deployment is evaluated. A key scoped to staging evaluates against the staging deployment; a key scoped to production evaluates against the production deployment.

Create separate keys for each environment in your pipeline:

• ci-staging-key → staging environment
• ci-production-key → production environment

Key Rotation

Rotate keys without downtime:

rotated = client.keys.rotate(
    project_id="PROJECT_ID",
    environment_id="ENVIRONMENT_ID",
    key_id="KEY_ID",
)

The old key remains valid for a grace period. Update your CI/CD secrets with the new key value.

Key Management

# List keys
keys = client.keys.list(project_id="PROJECT_ID", environment_id="ENVIRONMENT_ID")

# Revoke a key
client.keys.revoke(project_id="PROJECT_ID", environment_id="ENVIRONMENT_ID", key_id="KEY_ID")

Next Steps

• Environments: API key scoping
• Certification: automated compliance checks
• Deterministic Authorization: authorization patterns