Skip to main content
Every request except /healthz needs an Authorization header:
There are two kinds of credential. Applications should use API keys. Access tokens are short-lived and meant for the signed-in playground.
API keys cannot create, list, or revoke keys. Calling /v1/api-keys with an API key returns 403 with the code api_key_management_requires_login.

​
Managing keys

Keys are managed with POST, GET, and DELETE on /v1/api-keys, using a sign-in access token. You can also do this from the playground.

Create

List

Revoke

  • Naming: names are trimmed and must be 1 to 40 characters.
  • Expiry: 7d, 30d (default), or never.
  • No account limit: there is no cap on how many keys you can create.
  • Ownership: a key belongs to the account that created it. Requests made with a key and with that account’s login share the same identity, including idempotency scope.
  • Revocation: takes effect for requests authenticated after it completes. Decisions already accepted keep processing.
  • History: expired and revoked keys stay in your list for about 30 days, then disappear. Revoking a key that is gone returns 404.
Each key has metadata: id, name, last4, createdAt, expiresAt, revokedAt, and lastUsedAt. Dates are UTC ISO 8601 strings, or null. lastUsedAt is best effort and updates at most once a minute.

​
Keep keys safe

  • Store keys in a secret manager or environment variable, never in browser code.
  • Do not log Authorization headers or key creation responses.
  • If you lose a secret, revoke that key and create a new one. A secret cannot be recovered.
  • A timed-out POST /v1/api-keys may still have created a key. Reload the list and revoke any key you did not receive a secret for.

​
Authentication errors

See Errors for the full error format.