API Key Authentication

API key authentication is the simplest auth type in Corsair. You provide a static credential — an API key, personal access token, or bot token — and Corsair stores it encrypted in your database, then injects it into every request automatically.

How it works

Corsair stores your key using envelope encryption. Your KEK encrypts a per-connection DEK, which encrypts the key itself. The key is never stored in plaintext.

corsair.ts

import { createCorsair } from "corsair";
import { linear } from "@corsair-dev/linear";

export const corsair = createCorsair({
    plugins: [linear()],
    kek: process.env.CORSAIR_KEK!,
});

Store your key once with the CLI:

pnpm corsair setup --plugin=linear api_key=your-api-key

Every corsair.linear.api.* call will use the stored key automatically.

Solo setup

Solo mode means one API key shared across your entire application. This is the default — no extra configuration needed.

corsair.ts

export const corsair = createCorsair({
    plugins: [
        linear({ authType: "api_key" }),
    ],
    kek: process.env.CORSAIR_KEK!,
});

Store the key:

pnpm corsair setup --plugin=linear api_key=lin_api_your-key-here

All API calls use this key:

usage.ts

const issues = await corsair.linear.api.issues.list({ teamId: "team-id" });

Multi-tenant setup

In multi-tenant mode, each user supplies their own API key. Keys are stored and encrypted separately per tenant.

corsair.ts

export const corsair = createCorsair({
    multiTenancy: true,
    plugins: [linear()],
    kek: process.env.CORSAIR_KEK!,
});

Store each tenant’s key — for example, after collecting it during onboarding:

onboarding.ts

await corsair
    .withTenant("user_abc123")
    .linear.keys.set_api_key("lin_api_their-key");

Or via the CLI during development:

pnpm corsair setup --plugin=linear api_key=lin_api_tenant_key --tenant=user_abc123

Use withTenant to scope all API calls to a specific user:

usage.ts

const tenant = corsair.withTenant("user_abc123");

// Uses user_abc123's stored key — not your app's key
const issues = await tenant.linear.api.issues.list({ teamId: "team-id" });

Each tenant’s key is independently encrypted. Compromising one does not expose others.

Bring Your Own Key

If you manage your own decryption (e.g., AWS KMS or Google Cloud KMS), pass the decrypted key directly instead of using database storage:

corsair.ts

linear({
    key: await kms.decrypt(encryptedKey),
})

See Authentication for details.

Get Started

Adapters

Hub

Concepts

Management API

API Key Authentication

How it works

Solo setup

Multi-tenant setup

Bring Your Own Key

​How it works

​Solo setup

​Multi-tenant setup

​Bring Your Own Key

How it works

Solo setup

Multi-tenant setup

Bring Your Own Key