Credentials & access

Applies to1.1.0DifficultyBeginner

Oculis uses two kinds of credential, for two different purposes. People sign in as members of your organization; machines use a credential issued for a specific job.

Credential	Used by	Issued in
Deploy token	An Oculis Collector	Collectors → Collector Overview
API key	Your own scripts and tools	Settings → API keys

Deploy tokens

A deploy token authorizes a Collector to report into your organization. You receive one as part of the installation command generated when you choose Add Collector, and it is used only during installation and enrollment.

Treat a deploy token as a secret

Anyone holding a deploy token can enroll a Collector into your organization. Run the generated command only on the host you intend to monitor, do not share it, and do not commit it to source control or paste it into a ticket.

Deploy tokens are managed from Collectors → Collector Overview, where you can also see which Collectors are currently enrolled.

API keys

API keys authenticate programmatic access to your Oculis data — for example, pulling agent or cost data into a system you already run.

Create and revoke them in Settings → API keys. A key is shown once, when it is created; store it somewhere safe at that point, because Oculis cannot show it to you again. If a key is lost or exposed, revoke it and create a new one rather than trying to recover it.

Programmatic access is available on Premium and Enterprise plans. See Oculis API.

Member access

People access Oculis through their own accounts, not through shared credentials. What each member can see is determined by their role, so a member only has access to the parts of Oculis their role allows.

Manage members and their roles in Settings → Members. Organization-wide settings live under Settings → Organization.

Prefer roles to shared logins

Give each person their own account. Shared logins make it impossible to tell who changed something, and they cannot be revoked for one person without disrupting everyone.

If a credential is exposed

1. Revoke it first. For an API key, revoke it in Settings → API keys. For a deploy token, remove it from Collectors → Collector Overview.
2. Issue a replacement and update whatever was using the old credential.
3. Check what enrolled. For an exposed deploy token, review the Collectors list for any host you do not recognize.

Next steps

Oculis APIProgrammatic access to your Oculis data.

Oculis CollectorDeployment, capabilities, health checks, and troubleshooting.