DocsAPI ReferenceAPI Keys
API Key Management API
Generate, inspect, and revoke programmatic developer API keys.
POST /api/v1/api-keys
Creates a new API key. The raw secret key is returned exactly once in the response and is never stored in plaintext.
POST/api/v1/api-keys
Requires JWT session auth. Max 10 active keys per account.
Headers
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| Authorization | string | Required | Bearer <access_token> |
| Content-Type | string | Required | application/json |
Body Parameters
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| name | string | Required | Friendly label for the key (1 to 50 characters). |
Response Example (200 OK)
json/response.json
{"id": "770e8400-e29b-41d4-a716-446655440000","name": "Production Server Key","api_key": "vl_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6","prefix": "vl_live_a1b2c3","created_at": "2026-09-01T12:00:00Z"}
GET /api/v1/api-keys
Lists all active API keys associated with the authenticated account.
GET/api/v1/api-keys
Requires JWT session auth. Raw keys are never returned.
Headers
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| Authorization | string | Required | Bearer <access_token> |
Response Example (200 OK)
json/response.json
{"data": [{"id": "770e8400-e29b-41d4-a716-446655440000","name": "Production Server Key","prefix": "vl_live_a1b2c3","created_at": "2026-09-01T12:00:00Z","last_used_at": "2026-09-02T08:30:00Z"}]}
DELETE /api/v1/api-keys/:id
Immediately revokes an active API key. Subsequent requests using this key will fail with 401 Unauthorized.
DELETE/api/v1/api-keys/:id
Requires JWT session auth.
Headers
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| Authorization | string | Required | Bearer <access_token> |
Response Example (200 OK)
json/response.json
{"message": "api key revoked successfully"}