Console and API keys

What the console is for

The console is the operating surface of the scan product:

• Authorize repositories you want scanned.
• Press Scan. Scans run at rest, on your trigger, against the default branch.
• Read reports. Every finding with its evidence, plus the GitHub Check on the scanned commit.
• Copy fix prompts for Claude Code, Cursor, or Codex.
• Enable PR review per organization from the Reviews page (owner or admin; terms shown there).
• Manage billing (subscribe, spend cap, plan change) and mint Developer API keys.

Sign in at app.aevral.com/login with your GitHub account.

How access works

1. Install the GitHub App on your account or organization: https://github.com/apps/aevral.
2. Log in to the console with your GitHub account and claim your install.
3. Complete Setup to pick the first scan, or to turn PR reviews off. Claiming a new organization already starts reviews on. Free private baseline eligibility is shown there; paid first scans use included quota. Read reports and manage recurring paid scans from the console. The full order is on Set up with your agent.

API keys (Developer API)

Aevral API keys use the aevr_ prefix and exist today. Mint one from the console Developer API page. Keys are shown once at creation: copy them immediately, and mint a fresh one if a key is ever lost.

What a key can do today:

• Start a scan on a repository your organization has authorized (the console itself uses the same endpoint).
• Read scan status for your organization.

What a key cannot do:

• Billing is console-only. Checkout, plan changes, and the spend cap run on your authenticated console session and require owner or admin role; an aevr_ key is rejected on billing routes.
• A key never crosses organizations. It acts only for the organization it was minted under.

The fuller public API contract is coming. Until it is documented, do not invent endpoints beyond what the console uses.

The only other public API on this docs host is the docs search surface: /api/agent-search, documented in openapi.json. It indexes documentation only, needs no key, and cannot touch an organization.

What the console is not

• Not a patch generator: findings come with a fix prompt you hand to your coding agent. Plans and terms are on Pricing and plans.
• Not a continuous-integration server: scans are at rest, on your trigger.
• Not the GitHub App install surface: installs happen on github.com/apps/aevral. See GitHub App permissions.