Auth & API keys

Talos passes credentials to the target agent through headers. Nothing is stored server-side by Talos itself; credentials live in your environment for the duration of the scan.

Bearer tokens

❯ talos-scan --target https://api.example.com/agent \
            --adapter native \
            --header "Authorization: Bearer $TOKEN"

API keys / custom headers

Repeat --header for as many headers as needed. Values are expanded from your shell.

❯ talos-scan --target https://api.example.com/agent \
            --header "X-Api-Key: $API_KEY" \
            --header "X-Tenant: staging"

Mutual TLS

For internal agents behind mTLS, provide a client cert and key.

❯ talos-scan --tls-cert ./client.crt --tls-key ./client.key ...