Create an API key (secret shown once)
Issue a key for the business in the token. The response is the only time the secret exists outside the caller's system. Afterwards only its SHA-256 digest and prefix are stored.
Issue a key for the business in the token.
The response is the only time the secret exists outside the caller's system. Afterwards only its SHA-256 digest and prefix are stored.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/b/v1/api-keys" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "scopes": [ "payments:read" ] }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "mode": "test", "key_prefix": "string", "scopes": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "replaced_by_id": "a3d84e0a-4d68-4aaf-98ed-4d6a393ea8e5", "secret": "string"}List the business's API keys GET
Every key for this business, revoked ones included. Revoked keys stay visible: after an incident the question is which keys existed and when each stopped working, and hiding them answers neither. Secrets are absent from this response shape entirely.
Regenerate an API key, with an overlap window POST
Issue a replacement and let the old key expire, rather than killing it. The old key keeps authenticating for the configured overlap window (`API_KEY_REGENERATE_OVERLAP_MINUTES`), so the new one can be rolled out without a synchronised deploy. As with creation, the plaintext appears in this response and nowhere else, ever.