Skip to main content
Fleet (FleetDM) API keys allow you to interact directly with your Fleet instance — for example to run scripts, query device data, or integrate with other tools. You can create Fleet API keys directly from Primo or via the Fleet dashboard.

​
Generate a Fleet API key from Primo

1

Go to Settings > Developers

Scroll to the FleetDM API key section.
2

Enter a key name

Enter a Key name, for example the tool the key is for.
3

Click Generate key

4

Copy the token

Copy the token from the FleetDM API key created window. You can find it again later in the keys table.
Keys generated from Primo are read-only: they can view every device and its data, but cannot change settings or run actions on devices. Use them for external integrations that read your Fleet instance directly. To revoke a key, open the ⋯ menu on its row in the FleetDM API key table and click Revoke. Any integration using it stops working immediately.
Keep your Fleet API token secret and do not share it. Anyone who holds it can read your device inventory.

​
Generate a Fleet API key from the Fleet dashboard

1

Open your Fleet dashboard

Open it from the cockpit via Settings > MDM > Open Fleet.
2

Go to My account

Click your avatar in the top-right corner and go to My account.
3

Scroll to API token

4

Click Get API token

5

Copy the token

The token is tied to your Fleet user account.
Your Fleet API token has the same permissions as your Fleet user account. Keep it secret and do not share it.

​
Generate a Fleet API key from the CLI

You can also create Fleet API keys programmatically using the Fleet CLI:
Or create an API key directly via the Fleet API:

​
Use the Fleet API key

Pass the token in the Authorization header:

​
Regenerate or revoke a token

Fleet API tokens do not expire automatically. To revoke a key generated from Primo, go to Settings > Developers > FleetDM API key, open the ⋯ menu on its row and click Revoke. To revoke a token tied to your Fleet user account, go to My account in Fleet and click Regenerate API token. This immediately invalidates the previous token.