APIZDocs

APIZ guide

Web Console Quickstart

This quickstart connects GitHub, creates access for one agent, issues a one-hour Temporary Credential, sends a real request, and checks the evidence. The upstream GitHub token remains inside the API Instance boundary.

Prerequisites

  • the Web Console URL for your APIZ deployment;
  • permission to manage API Instances, Clients, and Temporary Credentials in the selected Team;
  • a GitHub token limited to the provider-side permissions needed for this test;
  • curl for the final request.

1. Sign In And Select A Team

  1. Open the APIZ site and select Start free or Log in.
  2. Complete the WorkOS sign-in flow.
  3. Open Console.
  4. Confirm the intended Team in the Console Team selector before creating resources.

The sign-in flow authenticates you to the APIZ Control Plane. Do not paste the GitHub token into the login flow.

2. Connect GitHub

  1. Open API Instances.
  2. Select Create API Instance.
  3. In Choose Adapter, select GitHub.
  4. In the setup step, enter quickstart-github as the name.
  5. Enter the GitHub token only in the field marked Secret. Official GitHub endpoint settings remain in Advanced GitHub settings and normally need no changes.
  6. Select Test Connection. The test should identify the authenticated GitHub user without showing the token.
  7. Select Create API Instance.
  8. In the success state, choose View Details and confirm the instance is ready.

The credential field is write-only. APIZ does not display the stored GitHub token after saving.

3. Create The Agent Client

  1. Open Clients.
  2. Select Create Client.
  3. Enter quickstart-release-agent and create the Client.
  4. On the Client detail page, select Add Binding.
  5. Choose the quickstart-github API Instance.
  6. Keep the suggested Route Alias or enter github.
  7. Leave Allow access without a Client Access Credential off.
  8. Leave Attach a Policy empty for this first request.
  9. Select Add Binding.

The Client now has a named route to GitHub but still has no plaintext credential in its runtime.

4. Issue One-Hour Temporary Access

  1. On the Client detail page, select Create Temporary Credentials.
  2. Confirm the github Binding is selected.
  3. Set expiry to one hour.
  4. Keep the recommended connection method and credential format.
  5. Review the endpoint and credential count, then select Create Credentials.
  6. In the one-time result, choose the cURL or Shell output for the GitHub Binding and copy it directly to the intended private runtime.

The result contains APIZ-issued credentials, not the GitHub token. It is still sensitive. APIZ does not store it in browser storage or show it as ordinary page content after the one-time setup state closes.

5. Send The Request

Use the endpoint and APIZ credential shown by the setup result. The exact cURL shape is generated for the selected credential format. A bearer-shaped request looks like:

curl -fsS \
  -H "Authorization: Bearer <apiz-temporary-credential>" \
  "<apiz-github-endpoint>/user"

Do not substitute the GitHub token into this command. The request must present the APIZ Temporary Credential to the APIZ endpoint.

6. Inspect And Revoke

  1. Open Logs / Audit.
  2. Stay on Access Logs and filter by the new Client or API Instance.
  3. Open the request row. Confirm the route, normalized request, decision, upstream result, request id, and redaction evidence.
  4. Return to the Client and open Temporary Credentials.
  5. Find the Credential Group created in this quickstart and select Revoke Group.
  6. Repeat the request and confirm it is no longer authorized.

Revocation stops the APIZ Temporary Credential. It does not delete the API Instance or revoke the upstream GitHub token.

Next Steps