create and scope the things stack api keys for applications and gateways using ttn-lw-cli
domain: thethingsindustries.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Authenticate the CLI first (ttn-lw-cli login) before creating any keys.
Create an application-scoped key with ttn-lw-cli applications api-keys create <application-id>, adding --name and specific --right-application-* flags for the permissions it needs (e.g. --right-application-traffic-read).
Create a gateway-scoped key with ttn-lw-cli gateways api-keys create <gateway-id> and its own --right-gateway-* flags, keeping gateway and application keys separate.
Set an expiry with --api-key-expiry <YYYY-MM-DDTHH:MM:SSZ> for keys that shouldn't be long-lived.
Store the returned key value immediately, since the Things Stack does not display the full key value again after creation.
Known gotchas
Granting --right-application-all or similarly broad rights when a narrower right (like traffic-read only) would do increases blast radius if the key leaks.
The API key value is only shown once at creation time; losing it means creating a new key rather than retrieving the old one.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?