API keys¶

API keys (sk_live_…) authenticate the API and SDKs. For day-to-day use, manage them in the dashboard → API Keys. They are also exposed over a session-authenticated endpoint used by the dashboard itself.

These endpoints require a logged-in dashboard session (cookie auth), not a Bearer key — so an API key cannot mint more API keys. This mirrors how Stripe handles key management.

List keys¶

GET /v1/api-keys

Returns key metadata (never the secret):

{
  "api_keys": [
    {
      "id": "1c6f778c-…",
      "name": "my-laptop",
      "scope": "full",
      "prefix": "sk_live_EfqzIi",
      "last4": "agxY",
      "created_at": "2026-06-23T17:37:43Z",
      "expires_at": null
    }
  ]
}

Create a key¶

POST /v1/api-keys

Field	Type	Notes
`name`	string	Required label
`scope`	string	`read` or `full` (default `full`)
`expires_in_days`	int?	Optional expiry

The response includes the plaintext secret exactly once:

{
  "id": "1c6f778c-…",
  "name": "my-laptop",
  "scope": "full",
  "key": "sk_live_EfqzIiub7dFKyak9IbuoPeCTt3KXFgrafXa0mcVagxY"
}

Store key immediately — it can never be retrieved again.

Revoke a key¶

DELETE /v1/api-keys/{id}

Revocation is immediate. Rotate by creating a new key, updating your app, then revoking the old one.

Scopes¶

Scope	Use
`read`	List/get resources only
`full`	Create, run code, mutate, delete

See Authentication for how scopes gate each endpoint. There is a per-account cap on the number of active keys.