Settings → Ingestion Connectors has two different Mode 3 paths. Neither is the file picker (that is Mode 2 Upload event log files).
Use this to register a cloud sink: GCP Cloud Logging (and the extra GCP types), AWS CloudTrail / CloudWatch, or Azure Monitor. XeroRisk gives you a push URL such as /internal/streams/{source_type}/{account_id}. On Production GCP, logs reach us through Pub/Sub and OIDC — you do not paste an API key into the Log Router. Pause, Resume, or Remove the stream from that table.
Remove hides the stream and ignores further pushes until you connect the same type again. It does not delete stored Mode 3 event rows. Use Delete live-stream events for that.
Use this when a customer machine will POST /api/v1/events/ingest and sign the body. You register an Ed25519 public key. The source type on that dialog is only a label for your systems.
After one active connector exists, ingest also requires X-XeroRisk-Connector-Id and X-XeroRisk-Signature. Dashboard file upload does not use those headers (Firebase session only). GCP live streams do not use them either.
These prove “some caller for this account.” Same auth as POST /api/v1/events/ingest.
· API key — Settings → API Keys → New API key. The full key is shown once. Send it as X-API-Key. Revoke it on that table. You cannot look the secret up again.
· OAuth2 — Settings → OAuth2 Clients → New OAuth2 client. client_id and client_secret are shown once. Your backend calls POST /api/v1/oauth/token with grant_type=client_credentials, then sends Authorization: Bearer <token>. Tokens last about an hour.
Copy-paste samples live on Settings → Integration Guide. Humans in the Dashboard still sign in with Firebase. These credentials are for machines only.
AWS or Azure buses aimed at /internal/streams/... can use the same API key or OAuth2 token. GCP Production live streams use OIDC instead.
These prove “this named source,” on top of the account credential.
· X-XeroRisk-Connector-Id — Settings → Ingestion Connectors, Connector ID column (copy button). After you click Create, a banner also shows the new id. Send that integer on every signed ingest. Revoke the connector to stop accepting it.
· X-XeroRisk-Signature — XeroRisk never gives you this. Keep the Ed25519 private key on your side. Sign SHA-256 of the raw request body and send that signature.
In New connector, click Generate keypair. The browser creates an Ed25519 pair on this computer, downloads the private PEM, and pastes the 44-character public key (32 raw bytes, base64 — the same string as openssl pkey -pubout -outform DER | tail -c 32 | base64). XeroRisk never sees the private key. If generation fails, the form is wiped so you can generate again.
If you already have a key on disk, the OpenSSL recipe on that page still works. Do not paste the private key into XeroRisk.
Check that the API key or Bearer token is not revoked, that Connector ID matches an active row, and that the signature was computed on the exact bytes you POST. Creating a connector does not open a live stream, and connecting a live stream does not create a signing key.
Still stuck? Email [email protected] with the Mode (1/2/3) and approximate time (UTC) — not private keys, API keys, or raw log bodies.