Authentication and scopes
Every request carries Authorization: Bearer wck_… (or X-Api-Key). Keys belong to your account
and can only see your own objects; anything else answers 404, exactly like an id that does not exist.
| Scope | Allows |
|---|---|
Module:Addons/GyroAPI/cloud_read | All GET endpoints under /cloud |
…/cloud_write | Power, rebuild, snapshots, rDNS, rename, SSH keys |
…/cloud_order | Spends money: create servers (paid from balance) |
…/cloud_delete | Cancel / delete servers |
Invoices/GetInvoices, Invoices/GetInvoice, Balance/GetBalance | Billing reads |
Give CI pipelines the smallest set they need and an IP allow list. Revoke a key in the client area at any time.