API keys and scopes
ClearScreen has no key with configurable scopes. Each key type has one job.
| Key | Starts with | Used for |
|---|---|---|
| Enrollment key | csk_ | Enrolling devices with clearscreen enroll. One per workspace, shown once when rotated. |
| Device key | csk_ | One per device. The agent uses it to fetch policy and report blocks. It is stored with 0600 permissions on the device and as a hash on the server. |
| Export token | csat_ | Reading block events and review reports for log forwarding. Admins can create and revoke them through the console API. |
Handling keys
- Treat the enrollment key as a secret. Rotating it stops new enrollments with the old key. Devices that are already enrolled keep working.
- Enrolling the same computer name again issues a new device key and the old one stops working.
- Only workspace admins can rotate the enrollment key or manage export tokens.
- Never put a key in a ticket, chat or screenshot.
Checking a domain
The public check endpoint answers for the shared feeds and categories. It needs no key and is rate limited.
curl "https://clearscreen.spot-suite.com/v1/check?domain=example.org"