There’s a command line in the gofi post I wrote ten days ago that has been quietly bugging me ever since I hit publish:
gofips -H 10.20.30.1 -k --get > hosts.conf
Look at that -k. That’s me telling the tool “don’t bother checking the TLS certificate.” And the part you can’t see is worse: my UniFi admin username and password, sitting in environment variables. Both of those were compromises I made to get the thing working. Neither of them sat well.
They’re gone now. gofi speaks cloud API keys through Ubiquiti’s Site Manager connector, and the whole command becomes this:
gofips --get
No host. No -k. No password anywhere. That’s the post.
Well — mostly. There’s a genuinely useful lesson buried in here about credentials, and one gotcha that cost me twenty minutes, so let’s do it properly.
## What Actually Changed
The old path — the one I shipped first — was the classic undocumented-UniFi-API dance. You log in with your admin credentials, the controller hands you a session cookie and a CSRF token, and you carry those around on every subsequent request. It works. It’s also the reason the tool needed to talk directly to the controller on my LAN, over that self-signed cert, with -k papering over the cert warning.
The new path routes through https://api.ui.com using an API key you create in your Ubiquiti cloud account. Two environment variables and you’re done:
To make the key: sign in at unifi.ui.com as Site Admin or Owner, click your profile icon, go to API, and create a key with the UniFi Applications → Network scope. Then find your console ID by asking Ubiquiti what consoles you own:
Pull your console ID out of that response, export it, and every gofi tool — gofips, gofimac, gofinet — just works. No flags.
The switch is automatic, too: if UNIFI_API_KEY is set, gofi takes the connector path. If it isn’t, it falls back to username and password exactly like before. Nothing I already had scripted broke.
## The Gotcha That Cost Me Twenty Minutes
Here it is, and I want it in bold because I want to save you the time:
A cloud API key from unifi.ui.com is NOT the same credential as an API key issued by the console’s own UI.
Your UDM Pro will happily let you mint a key in its local admin interface. That key is a perfectly good key… for talking to that console directly. The Site Manager connector will not accept it. You need the cloud key, created in your Ubiquiti account at unifi.ui.com, and it needs the Network scope on the UniFi Applications entry.
I did exactly the wrong one first, got a flat rejection, assumed my code was broken, and went spelunking in my own transport layer. Geesh. Two identical-looking secrets, two entirely different trust domains. Read that paragraph twice and don’t be me.
## Why This Is Better Than It Sounds
Three reasons, and they’re all worth more than the flags they removed.
> # [Stop Putting Your UniFi Admin Password in an Env Var · Greg Herlein](https://blog.herlein.com/post/gofi-api-keys/)