API keys (for scripts and other machines)

Settings → General → API keys issues keys for anything that isn't a browser: scripts, a terminal, another machine.

A key has the same access as signing in. Treat it like the password.

Issuing one

1. Settings → General → API keys.
2. Name it for what will use it — "laptop script", "backup box". The name is the only thing you will have to go on later when deciding whether a key is still needed, since you cannot read the key itself back.
3. Create key.
4. Copy it now. It is shown once, at creation, and stored only as a hash. There is no way to retrieve it afterwards — if you lose it, revoke it and issue another.
5. Send it as an X-Api-Key header, which is what the *arrs use, or as Authorization: Bearer <key>.

curl -H "X-Api-Key: <your key>" http://localhost:8787/api/v1/libraries

Revoking asks first and takes effect immediately. Anything using that key stops working at once, so revoke a key you are replacing only after the replacement is in place.

The list shows each key's name and its first few characters, which is enough to tell two apart without exposing either.