API Keys

Create, inspect, and revoke API keys

Manage API keys with account endpoints.

Send Verification Code

POST /auth/api-key/send-code

Response 200 OK

Sends the email confirmation code required for API key creation.

Create API Key

POST /auth/api-key

Request Body

Field	Type	Required	Description
code	string	Yes	Email confirmation code
otp	string	No	2FA OTP code if 2FA is enabled
expiresAt	string	No	Expiration time in ISO 8601. null means no expiry

Response 200 OK

{
  "id": "key_live_primary",
  "key": "op_k_live_primary",
  "secret": "sec_live_primary_base64url",
  "createdAt": "2026-01-15T10:30:00Z",
  "expiresAt": null
}

Field	Type	Description
id	string	API key record ID
key	string	Public API key
secret	string	Secret for HMAC signing
createdAt	string	Creation timestamp in ISO 8601
expiresAt	string	Expiration timestamp or null

The secret is returned only once.

Creating a new key deactivates the previous key.

Get Active API Key

GET /auth/api-key

Response 200 OK

Returns active key metadata. The secret is not returned.

Revoke API Key

DELETE /auth/api-key

Response 200 OK or 204 No Content

Revokes the active key.