Ctrlk
Sign up for FreeKnowledge Base
For the complete documentation index, see llms.txt. This page is also available as Markdown.

🔐Authenticating with the P0 API

Get a bearer token to authenticate with the P0 Management API and the P0 Terraform provider, using a Google Cloud service-account token, the P0 CLI, or an API key.

P0's programmatic surfaces all authenticate the same way: with a bearer token. This includes the Management API, the just-in-time access API, the inventory export API, and the P0 Terraform provider.

You supply the token in one of two ways:

  • API and direct HTTP calls — pass it in the Authorization header: Authorization: Bearer <token>.

  • Terraform provider — set the P0_API_TOKEN environment variable or the provider's api_token attribute.

This page explains how to get a token and which method to use.

Choose an authentication method

Method
Best for
Notes

Google Cloud service-account token

CI/CD and automation

Recommended. Short-lived, no stored secret. Requires Google Cloud.

P0 CLI token

Local development and interactive use

Tied to your P0 login. Short-lived.

API key

Existing integrations

Legacy. Being phased out in favor of a service-account token.

The token's privileges come from the P0 role of the identity behind it, so grant each identity the least privilege it needs. See Role-based access control.

Google Cloud service-account token (recommended)

A workload running on Google Cloud can authenticate as a service account with a short-lived identity token, so no long-lived secret needs to live in your CI system. P0 accepts a Google-issued service-account identity token as a bearer token.

  1. Choose a service account for the workload to run as.

  2. Grant it a P0 role. In the P0 dashboard, open P0 Management → Role-Based Access Control and add the service account's email as a member. The role you assign governs what the identity can do: add it as a Security Reviewer for read-only access, or as an Owner for a pipeline that creates or modifies integrations, policies, or settings. The service account's email must be a member of your P0 organization, or P0 rejects the token.

  3. Mint a short-lived identity token and use it as your bearer token. The audience must be your P0 organization URL, https://p0.app/o/<your-org>, and the token must include a verified email:

    export P0_API_TOKEN="$(gcloud auth print-identity-token \
  --impersonate-service-account="p0-ci@my-project.iam.gserviceaccount.com" \
  --audiences="https://p0.app/o/my-org" \
  --include-email)"

  4. Use the token. With P0_API_TOKEN set, the Terraform provider and any API call authenticate as the service account.

The token is short-lived (about one hour), so mint it in the same job that uses it. The audience must match your organization URL exactly, and the token must carry a verified email (--include-email)—without it, the minted token omits the email claim and P0 rejects it.

P0 CLI token

For local development, authenticate with your own P0 login through the P0 CLI.

  1. Log in to your organization:

    The CLI completes a browser single sign-on flow and stores your session in ~/.p0/identity.json.

  2. Use the session:

    • With the Terraform provider — you don't need a token. When api_token and P0_API_TOKEN are both unset, the provider automatically uses your CLI session.

    • With the API — print a bearer token from your session and pass it in the Authorization header:

These tokens are short-lived and tied to your login, so use them for local development rather than durable automation. The token acts as you, with your P0 role.

API key (legacy)

API keys are legacy and are being phased out in favor of Google Cloud service-account tokens. They still work, but prefer a service-account token for new integrations. A P0 API key carries the full Owner role and cannot be scoped to a lesser role.

An API key is a long-lived secret you generate in the P0 dashboard. To create one, see Generating an API key. Use it as your bearer token or export it as P0_API_TOKEN.

Use your token

The token you obtained works the same way regardless of how you got it.

With the P0 APIs

Pass the token in the Authorization header. The base URL includes your organization identifier:

With the Terraform provider

Set the token in the P0_API_TOKEN environment variable, or pass it as the provider's api_token attribute:

The provider resolves the token in this order: the api_token attribute, then the P0_API_TOKEN environment variable, then your P0 CLI session. Prefer the environment variable or a secrets manager over hardcoding the token in configuration.

Best practices

  • Prefer short-lived tokens. A Google Cloud service-account token or a CLI token expires on its own; an API key does not.

  • Grant least privilege. The token inherits the P0 role of its identity. Use a read-only role such as Security Reviewer where write access is not required.

  • Never commit tokens. Use an environment variable or a secrets manager, and rotate any long-lived secret regularly.

Related

PreviousGet started with the P0 Terraform provider
NextManage P0 policies and settings as code

Last updated