Manage API Keys

List your workspace API keys (masked), mint a new scoped key (the raw secret is returned once), and revoke a key.

These endpoints let a workspace manage its own API keys programmatically. List your keys (always masked — the raw secret is never returned again), mint a new key with a name and a chosen scope set, and revoke a key you no longer need. The raw secret of a new key is returned exactly once, on creation; store it immediately.

A key carries a subset of the valid scopes — extract, read, write, operations, billing, delivery. If you omit scopes on create, the key defaults to extract, read, write, operations. Revocation is scoped to your own workspace, so you can never revoke another tenant's key.