> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsair.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Authentication

> Use static API keys and tokens with Corsair plugins.

API key authentication is the simplest auth type in Corsair. You provide a static credential, such as an API key, personal access token, or bot token, and Corsair stores it encrypted in your database, then injects it into every request automatically.

## How it works

Corsair stores your key using [envelope encryption](https://docs.cloud.google.com/kms/docs/envelope-encryption). Your KEK encrypts a per-connection DEK, which encrypts the key itself. The key is never stored in plaintext.

```ts corsair.ts theme={null}
import { createCorsair } from "corsair";
import { linear } from "@corsair-dev/linear";

export const corsair = createCorsair({
    plugins: [linear()],
    kek: process.env.CORSAIR_KEK!,
});
```

Store your key once with the CLI:

```bash theme={null}
pnpm corsair setup --plugin=linear api_key=your-api-key
```

Every `corsair.linear.api.*` call will use the stored key automatically.

## Solo setup

Solo mode means one API key shared across your entire application. This is the default, no extra configuration needed.

```ts corsair.ts theme={null}
export const corsair = createCorsair({
    plugins: [
        linear({ authType: "api_key" }),
    ],
    kek: process.env.CORSAIR_KEK!,
});
```

Store the key:

```bash theme={null}
pnpm corsair setup --plugin=linear api_key=lin_api_your-key-here
```

All API calls use this key:

```ts usage.ts theme={null}
const issues = await corsair.linear.api.issues.list({ teamId: "team-id" });
```

## Multi-tenant setup

In multi-tenant mode, each user supplies their own API key. Keys are stored and encrypted separately per tenant.

```ts corsair.ts theme={null}
export const corsair = createCorsair({
    multiTenancy: true,
    plugins: [linear()],
    kek: process.env.CORSAIR_KEK!,
});
```

Store each tenant's key, for example after collecting it during onboarding:

```ts onboarding.ts theme={null}
await corsair
    .withTenant("user_abc123")
    .linear.keys.set_api_key("lin_api_their-key");
```

Or via the CLI during development:

```bash theme={null}
pnpm corsair setup --plugin=linear api_key=lin_api_tenant_key --tenant=user_abc123
```

Use `withTenant` to scope all API calls to a specific user:

```ts usage.ts theme={null}
const tenant = corsair.withTenant("user_abc123");

// Uses user_abc123's stored key — not your app's key
const issues = await tenant.linear.api.issues.list({ teamId: "team-id" });
```

Each tenant's key is independently encrypted. Compromising one does not expose others.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.