Console and API keys

What the console is for

The console is the operating surface of the scan product:

• Authorize repositories you want scanned.
• Press Scan. Scans run at rest, on your trigger, against the default branch.
• Read reports. Every finding with its evidence, plus the GitHub Check on the scanned commit.
• Suggested fixes for Claude Code, Cursor, or Codex.
• Turn PR review off or on per organization from the Reviews page (on by default from install; owner or admin; terms shown there).
• Manage billing (subscribe, spend cap, plan change) and mint Developer API keys.

Sign in at app.aevral.com/login with GitHub. The console connects the matching install automatically. Google, Microsoft and email sign-ins can use an organization they were invited to, but cannot connect an install.

How access works

1. Install the GitHub App on your account or organization: https://github.com/apps/aevral.
2. Sign in to the console with GitHub; it connects the matching install automatically.
3. Finish Setup, where you can also turn PR reviews off. Reviews already started at install. Trial remaining is shown on Scans; paid first scans use included quota. Read reports and manage recurring paid scans from the console. The full order is on Set up with your agent.

API keys (Developer API)

Aevral API keys use the aevr_ prefix and exist today. Mint one from the console Developer API page. Keys are shown once at creation: copy them immediately, and mint a fresh one if a key is ever lost.

What a key can do today:

• Start a scan on a repository your organization has authorized (the console itself uses the same endpoint), and read its status. See Scan API.
• Read your organization's plan and usage with GET /v1/usage. The response can carry a billing link that an owner or admin opens in the console.

What a key cannot do:

• Billing is console-only. Checkout, plan changes, and the spend cap run on your authenticated console session and require owner or admin role; an aevr_ key is rejected on billing routes and cannot subscribe or upgrade.
• A key never crosses organizations. It acts only for the organization it was minted under.

Coding agents look for the key in the AEVRAL_API_KEY environment variable and never ask for it in chat. The documented key routes are POST /v1/scans, GET /v1/scans/{id} (Scan API) and GET /v1/usage (Usage API). Do not invent other endpoints.

The only other public API on this docs host is the docs search surface: /api/agent-search, documented in openapi.json. It indexes documentation only, needs no key, and cannot touch an organization.

What the console is not

• Suggested fixes are yours to apply in Claude Code, Cursor, or Codex. The console does not commit or merge. Plans and terms are on Pricing and plans.
• Not a continuous-integration server: scans are at rest, on your trigger.
• Not the GitHub App install surface: installs happen on github.com/apps/aevral. See GitHub App permissions.