Where do I find my Civo API key?

In the Civo dashboard, under your account's Security section, reachable directly at dashboard.civo.com/security. Keys are listed there and each one has a Regenerate button next to it. The key is not created in the CLI or in any third-party app; those only consume a key you generated in the dashboard.

Is it safe to store a Civo API key on my Mac?

It depends on where it is stored. The Civo CLI writes the key into .civo.json in your home directory, a plain file protected only by file permissions. CivoCloudManager writes it to the macOS Keychain as a generic password item that is readable only while the Mac is unlocked, and gates revealing other stored secrets behind Touch ID. Either way, the key grants full account access, so treat it like a password.

What happens if I rotate or revoke my Civo API key?

Regeneration in the Civo dashboard takes effect immediately, so every client holding the old value starts failing on the next request. Fix it in one place: paste the new key into the app's settings and it replaces the Keychain entry, or run civo apikey add followed by civo apikey current for the CLI. Nothing else needs changing, because the region, firewall selection and IP presets are stored separately.

Can I use more than one Civo account?

Not at the same time in CivoCloudManager. The app holds one API key in the Keychain, and switching accounts means replacing that key. The Civo CLI is better here: it stores several named keys and switches between them with civo apikey current . If you juggle accounts all day, keep the CLI for that and use the app for the account you actually watch.

Do I still need the Civo CLI?

For CI/CD, scripting and anything that has to run without a human, yes, and the CLI is the right tool for it. For day to day work on a Mac you do not. The app talks to the same Civo REST API v2, reaches the Kubernetes API over client-certificate mTLS without kubectl, and covers pod logs, S3 object browsing and cost figures the CLI does not ship. Many people end up running both.

Connect your Civo API key on a Mac, once.

Generate the key in the Civo dashboard, paste it once, and let the macOS Keychain hold it from then on.

Every Civo account starts the same way on a Mac: you need an API key before anything else works. The usual route is the Civo CLI, which writes the key into a plain JSON file in your home directory and expects you to manage it from there. CivoCloudManager takes the same key, validates it against the Civo REST API v2 while you are still in onboarding, and stores it in the macOS Keychain instead of a dotfile. This page shows both paths, so you can pick the one that fits.

Connecting the key in CivoCloudManager

01

Open the menu bar shield.

On first launch the app puts a shield icon in the menu bar. Clicking it starts a six step onboarding flow. There is no account to create and nothing to sign up for, because the app talks to Civo directly.
02

Paste the API key and validate it.

The key goes into a secure text field. Press Validate and the app calls Civo with it before letting you continue, so a typo or an already regenerated key fails here rather than three screens later. A valid key is confirmed inline.
03

Choose your region.

The app loads the live region list from your account and shows each region with its country. The selected region becomes the default for requests that need one. Individual requests can still target a different region explicitly.
04

Select the firewalls to manage and set a port for each.

Onboarding discovers the firewalls in your account, grouped by region, and lets you tick the ones the menu bar should control. Each one gets a port, defaulting to 6443 for the Kubernetes API server. You can skip this and configure it later.
05

Optionally enable Launch at Login.

This registers the app with SMAppService so the menu bar shield is there after a reboot. It matters if you use timed firewall access, because the app has to be running and able to reach Civo to close a rule it opened.

Where the Civo API key comes from

The key is generated in the Civo dashboard, not in any client. Sign in, open the account area and go to the Security section, reachable directly at dashboard.civo.com/security, where your API keys are listed. Civo's own documentation describes rotation there too: pressing Regenerate next to a key resets it, the change is immediate, and every subsequent request has to use the new key. Treat the value like a password, because it carries full access to your account. If you are unsure whether a key is still the current one, regenerate it and paste the new value, rather than debugging a 401.

The CLI path, for comparison

The official Civo CLI stores keys under names. You add one with civo apikey add <name> <key>, make it the active one with civo apikey current <name>, and review what you have with civo apikey list. All of it lands in a file called .civo.json in your home directory, together with settings such as the region. The path can be moved with the CIVO_CONFIG environment variable or the --config flag. This is the right tool for CI/CD and for scripting, and it is worth saying plainly: the CLI handles multiple named accounts better than the app does. What it does not do is protect the key with anything beyond file permissions.

What happens to the key on your Mac

CivoCloudManager writes the key to the macOS Keychain as a generic password item, accessible only while the Mac is unlocked, never to a config file in your home directory. Revealing stored secrets inside the app, such as instance passwords, database passwords and object store secret access keys, is gated by Touch ID through LocalAuthentication. Your Civo key is sent to one host only, api.civo.com, the Civo REST API v2. No server belonging to the publisher sits in that path and the app collects no telemetry. It runs in the App Sandbox with four entitlements: sandbox, outgoing network client, user-selected read and write files for exports, and app-scoped bookmarks. One honest footnote: to open a firewall for your current address the menu bar has to learn your public IP, which it asks a public IP echo service. That request carries no Civo credentials.

The same key reaches the Kubernetes API, so kubectl is optional

Your API key fetches the cluster kubeconfig from Civo, and the kubeconfig is where Kubernetes access actually lives. The app parses the kubeconfig in Swift, imports the PEM certificate and private key with SecItemImport, pairs them with SecIdentityCreate, and opens client-certificate mTLS from URLSession. No kubectl, no openssl, no shell-out. The kubeconfig CA becomes the only trust anchor for that connection, and a wrong host, an unrelated CA or an expired leaf certificate cannot take the accept path. Pod logs, workloads, events and node metrics come through that connection. You can still export the kubeconfig as a .yaml file and use kubectl whenever you prefer it.

You do not have to buy anything to use the key

Menu bar firewall management is free permanently: open and close access for your current public IP, per-firewall ports, named IP presets, timed access of 15 minutes, 30 minutes, one hour or two hours, and a bulk close. The full resource dashboard is free for seven elapsed days from first launch, then needs a one-time purchase from the Mac App Store, with Family Sharing. No card, no subscription, no account on our side. Requires macOS 15 or later, Apple silicon or Intel.

Questions people ask about Civo API keys

Where do I find my Civo API key?: In the Civo dashboard, under your account's Security section, reachable directly at dashboard.civo.com/security. Keys are listed there and each one has a Regenerate button next to it. The key is not created in the CLI or in any third-party app; those only consume a key you generated in the dashboard.
Is it safe to store a Civo API key on my Mac?: It depends on where it is stored. The Civo CLI writes the key into .civo.json in your home directory, a plain file protected only by file permissions. CivoCloudManager writes it to the macOS Keychain as a generic password item that is readable only while the Mac is unlocked, and gates revealing other stored secrets behind Touch ID. Either way, the key grants full account access, so treat it like a password.
What happens if I rotate or revoke my Civo API key?: Regeneration in the Civo dashboard takes effect immediately, so every client holding the old value starts failing on the next request. Fix it in one place: paste the new key into the app's settings and it replaces the Keychain entry, or run civo apikey add <name> <key> followed by civo apikey current <name> for the CLI. Nothing else needs changing, because the region, firewall selection and IP presets are stored separately.
Can I use more than one Civo account?: Not at the same time in CivoCloudManager. The app holds one API key in the Keychain, and switching accounts means replacing that key. The Civo CLI is better here: it stores several named keys and switches between them with civo apikey current <name>. If you juggle accounts all day, keep the CLI for that and use the app for the account you actually watch.
Do I still need the Civo CLI?: For CI/CD, scripting and anything that has to run without a human, yes, and the CLI is the right tool for it. For day to day work on a Mac you do not. The app talks to the same Civo REST API v2, reaches the Kubernetes API over client-certificate mTLS without kubectl, and covers pod logs, S3 object browsing and cost figures the CLI does not ship. Many people end up running both.

Guides

Step by step, and honest comparisons.

Deep dives

Targeted reads for each Civo product.

Every Civo surface CivoCloudManager touches has its own page with the specifics, the trade-offs, and the architecture details. Pick the one closest to what you do today.

The menu bar firewall costs nothing.

Download CivoCloudManager from the Mac App Store, paste your key once, and open or close firewall access for your current IP from the menu bar for free, with no purchase required.

Download on the Mac App Store

Requires macOS 15 (Sequoia) or newer.

Back to the overview