API key or authenticator code: which do you need?
Paramant has two kinds of credential, each with its own job. The account key is for machines and scripts. The 6-digit code (or your passkey) is for signing in to the website yourself. You never need both at the same time.
The short version
API key
- A static secret string:
pgp_followed by 64 hex characters - Identifies your account to the API
- Does not expire automatically
- Issued once, stored by you
- Used by machines, scripts, and integrations
TOTP code
- A 6-digit code that changes every 30 seconds
- Proves you have your authenticator device with you
- Generated by your authenticator app
- Cannot be reused or stolen from logs
- Used to sign in to the website yourself, with your email address
When you need only the API key
Machine-to-machine calls use the API key alone. That covers IoT devices, CI pipelines and server scripts. The key goes in the X-Api-Key header on every request. No TOTP code is required because the machine cannot open an authenticator app. You find the key on Account under Advanced account key.
Each account has one account key. The API keys you create on your account page with a Firm plan or higher (starting with psk_live_) are for the ParaSign API. You create and revoke those yourself, one per integration. They are separate from the account key.
Signing in to the website yourself
Signing in at paramant.app/en/auth/login does not ask for an API key. It works like this:
- Enter your email address
- Sign in with your passkey, or choose Use a 6-digit code instead and enter the current code from your authenticator app
If your authenticator app is not at hand, sign in with a backup code at paramant.app/en/auth/backup.
Why Paramant has no password
Paramant has no passwords. You prove who you are with something you have: a passkey on your device or the authenticator app on your phone. So there is no password to remember, reuse, or take over through a reset email.
Replace (rotate) your API key
You cannot make a new account key on the website yourself at the moment. If you think it leaked, mail privacy@paramant.app straight away from your account address; we replace it. Then put the new key in every integration that uses it. A psk_live_ key you do revoke yourself, on your account page.
Common questions
psk_live_ key, revoke it yourself on your account page. Treat any transfers made with the old key as potentially compromised and notify your recipients if the content was sensitive.