Managing projects, keys, and encryption

Who this is for

This page is for operators and administrators who own or manage a Guard Core account, the people responsible for setting up projects, issuing keys, managing encryption, and controlling who has access to what.

What you can manage

Guard Core gives operators full control over the organizational primitives that gate access to telemetry collection: projects (the logical grouping of agent connections), API keys (the credentials agents use to authenticate), per-project encryption settings, and the organization membership that controls who can act on any of the above.

Projects

A project is the unit of isolation in Guard Core. Each project has its own API keys, its own encryption posture, and its own stream of incoming telemetry. If you run multiple applications or environments - production, staging, a separate internal tool - each gets its own project so that events, metrics, and rules stay cleanly separated.

You can create new projects, rename them, and archive them from the dashboard. For a detailed walkthrough of how keys and projects relate from day one, see API keys & encryption setup.

API keys

API keys are what guard-agent instances present when shipping telemetry. You can issue new keys, revoke existing ones, and optionally configure encryption at the moment a key is created. Revocation takes effect immediately. Any agent still carrying the old key will be rejected at the next request.

Keys are scoped to a project. A single project can have multiple active keys, which makes zero-downtime key rotation straightforward: issue the new key, roll it out to agents, then revoke the old one.

For the end-to-end connection flow, see the quickstart. For a deeper look at key lifecycle and what happens under the hood, see API keys & encryption setup.

Project encryption

Guard Core supports per-project AES-256-GCM encryption for telemetry payloads. When encryption is enabled, agents encrypt their event batches before transmission and the server decrypts them using the project's stored key. Raw event content never crosses the wire in plaintext.

From the dashboard you can enable encryption on a project, rotate the active key, and disable encryption if it is no longer needed. Rotation requires coordinating the agent rollout with the key change to avoid a gap in event delivery. The full rotation procedure and its timing requirements are documented in Encryption key rotation. If encrypted events start being rejected after a rotation, see Encrypted events rejected after key rotation.

Organizations and members

An organization in Guard Core groups one or more operators under a shared account boundary. You can create an organization, invite team members by email, and assign each member a role. Role-based access controls who can do what - for example, which members can create projects or revoke keys - without requiring every team member to share a single set of credentials.

Member management is done entirely in the dashboard. Role assignments can be changed or revoked at any time.

Where to do it

All of the management operations described above - creating projects, issuing and revoking keys, configuring encryption, managing organization membership - are performed through the dashboard at app.guard-core.com. Step-by-step how-to guides for common tasks are in a dedicated how-to section of the docs.

A note on programmatic access

The only documented, supported programmatic interface is the agent telemetry API. That surface is what guard-agent uses to ship events, metrics, and health signals, and it is the only API contract Guard Core publishes and maintains.

The management operations described on this page are performed through the dashboard. The underlying server routes that power those dashboard interactions are internal and are not a published or stable contract. Automation or tooling that calls those internal routes directly is outside the supported model and may break without notice as the platform evolves. If you need to automate account management tasks, reach out to discuss supported options rather than reverse-engineering internal endpoints.