- The gofi tool previously required admin credentials and insecure TLS (-k flag) to talk to a local UniFi controller.
- Now gofi uses scoped, revocable cloud API keys from unifi.ui.com via the Site Manager connector, needing only two environment variables.
- A crucial gotcha: cloud API keys from unifi.ui.com are different from console-issued keys; only the cloud key works with the connector.
- Cloud API keys are scoped to Network access, revocable in 90 seconds, and reduce the blast radius if leaked compared to an admin password.
- The new method uses verified TLS (no -k) and works remotely without VPN or SSH tunnels, enabling network administration from anywhere.
- The local DNS drift/overlap audit is skipped when using the cloud path; users should occasionally run the old LAN path for full checks.
- The change cascades to all gofi tools and a Claude skill, allowing natural-language device management from hotel rooms via a travel router.
- The old username/password path remains fully supported as a fallback.
- The general lesson: scoped machine credentials are safer than embedding admin passwords in automation, making recovery cheaper and risk smaller.