Reference

Credentials & Security

Choose the credential for the job. Create and revoke credentials in Settings → Credentials.

Application telemetry: SDK key · cup_sdk_; Publishable; sends events for one project.
REST API or CI job: API token · cup_api_; Secret; keep it on the server or in CI secrets.
AI tool using MCP: OAuth; Sign in and approve the requested access.
Public status badge: No credential; Never put a key or token in the URL.

Repository provider access

Connect the GitHub or GitLab account that can access your repository. Check the provider's consent screen and any organization approval requirements.

GitHub requests repo, read:org and read:user. The repo scope is broader than read-only access. GitLab requests read_api, read_user and read_repository.

Repository analysis can store selected source files in full. Read what scans collect before granting access.

SDK keys: send project telemetry

Open SDK Keys, select a project and copy the new key. Check SDK availability and setup before installation.

A key can send events to https://ingest.checkupstream.com/v1/events. It cannot read organization data or call the REST API. It may appear in a browser bundle, so anyone with the key can submit events, including misleading data. The ingest service applies per-key and per-IP rate limits. These do not authenticate your app.

Origins are not enforced

The allowed-origins list in Settings is not a security control. The ingest endpoint does not read the Origin header; an origin entry does not restrict use of the key.

To replace a key: create a new one, update your application, then revoke the old key. Ingest caches valid keys for up to two minutes, so revocation may take that long.

API tokens: access the REST API

Open API Tokens, choose the minimum permissions and an expiration, then copy the token. Keep it out of browser bundles and public repositories.

Bash

curl https://checkupstream.com/api/v1/incidents \
  -H "Authorization: Bearer $CHECKUPSTREAM_API_TOKEN"

Scope	Access
`read`	Read organization resources
`write`	Read, create and update resources
`admin`	Administrative access, including team and billing operations

Check the endpoint's requirements in the API reference. Telemetry accepts an SDK key in the body; public badges need no token.

If a token is exposed: revoke it, replace it in every consumer and review unexpected activity. Removing it from the latest commit does not remove it from repository history.

AI connections: authorize with OAuth

Follow the MCP setup guide, sign in and approve access for the correct organization. You do not need to paste an API token into the connection.

The client manages OAuth access and refresh tokens; storage depends on the client. Revoke access under AI Connections.

Public badges: no credential

Anyone with your organization slug can request its aggregate dependency status at /api/v1/badge/{org_slug}. The badge does not expose project lists or individual vendor names.

To hide the aggregate, turn off Settings → Organization → Public Badges. Requests then return a neutral Private badge. Use the credential-free badge examples.

Check an existing integration

Wrong credential or missing data?

Check the prefix. cup_sdk_ sends telemetry; cup_api_ authorizes REST requests. An environment variable's name does not tell you which value it holds.
Check the project. A valid SDK key for another project sends measurements there.
Replace exposed credentials. Revoke exposed API tokens. Replace an SDK key if untrusted submissions are affecting your measurements.

Manage your credentials

Create, rotate or revoke access for your integration.

Open credentials API authentication