Skip to main content
Expanse authenticates users with a personal API key, created from the Console settings page after you sign in through your organisation’s SSO. Your API key is the only long-lived credential you hold; compute registration hands you a single-use, short-lived install token that the installer exchanges for the compute’s own credential.

​
Sign in

Provide your personal exp_user_* API key (via --api-key or the EXPANSE_API_KEY environment variable); the CLI mints and stores a local session. The key itself is created in the Console, not by the login command. Confirm it worked:

​
Personal API key

Your personal exp_user_* key is scoped to the teams and computes you can access. It authenticates your CLI session; behind the scenes the CLI exchanges it for short-lived signed tokens automatically, so the key itself never travels beyond sign-in. Console sessions use your SSO sign-in, not the API key. If you suspect a key is compromised, revoke it from console.expanse.sh/settings and sign in again.

​
Compute credentials

When a compute is registered, the daemon receives its own credential automatically: the installer exchanges the single-use install token for it and writes it straight into the daemon config. You never need to read or type it; on Kubernetes you mount the generated config file into the chart as a Secret. To replace a compute credential, re-register the compute with expanse compute register and run the printed install command again.

​
Privacy-aware deployments

Expanse runs hosted by default. Privacy-conscious enterprises can instead run the data plane and intelligence plane inside their own infrastructure, so workload telemetry, source bundles, and intelligence reasoning stay on your network; in that mode only identity (SSO, organisation membership, licence validation) goes through the Expanse control plane. SSO ties into your existing IdP (Okta, Entra, Google Workspace, or any OIDC-compatible provider). Reach out for a deployment walkthrough.