API keys API

Use GET /v1/account when you need to confirm which dashboard account, project, environment, and API key a bearer token belongs to. The /v1/me path is an alias for agents and clients that look for a whoami-style route.

Current account

GET/v1/account

Requires a valid bearer API key but no additional scope. The response includes one dashboard owner contact for account matching, and never returns plaintext API-key secrets or the full member list.

Response

Field	Type	Notes
`object`required	"account_profile"
`organization`required	object
`project`required	object
`environment`required	object
`api_key`required	object
`dashboard_owner`required	object \| null

Current account alias

GET/v1/me

Alias of GET /v1/account.

Response

Field	Type	Notes
`object`required	"account_profile"
`organization`required	object
`project`required	object
`environment`required	object
`api_key`required	object
`dashboard_owner`required	object \| null

Agents can bootstrap a first key with the unauthenticated device flow below. The approved credential is a Tyxter kind=agent API key, not an OAuth access token for public /v1/* routes. API keys can create child keys only with strict subset scopes, and API-key callers can never grant api_keys:admin. Create and rotate responses return the plaintext secret once.

Agent device authorization

POST/v1/agent-api-key-device-authorizations201 Created

Create a 15-minute device request without an Authorization header. Send the dashboard owner/admin to verification_uri_complete; approval selects the target project and environment.

Request body

Field	Type	Notes
`client_name`required	string	len 1..80
`environment`required	"sandbox" \| "production"
`scopes`required	string[]
`expires_at`	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$

Response

Field	Type	Notes
`object`required	"agent_api_key_device_authorization"
`device_code`required	string	len 1..∞
`user_code`required	string	len 1..∞
`verification_uri`required	string
`verification_uri_complete`required	string
`expires_in`required	integer	range -∞..9007199254740991
`interval`required	integer	range -∞..9007199254740991

Agent device token poll

POST/v1/agent-api-key-device-authorizations/token

Poll without an Authorization header using the returned device_code. HTTP 202 means the request is still pending. HTTP 200 returns the one-time API key and preflight checks. Terminal errors include invalid_device_code, device_code_expired, and authorization_denied.

Request body

Field	Type	Notes
`grant_type`required	"urn:ietf:params:oauth:grant-type:device_code"
`device_code`required	string	len 1..∞

Response

Field	Type	Notes
No fields.

Create

POST/v1/api-keys201 Created

Request body

Field	Type	Notes
`name`required	string	len 1..∞
`environment`required	"sandbox" \| "production"
`scopes`required	string[]
`expires_at`	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$

Response

Field	Type	Notes
`id`required	string
`object`required	"api_key"
`name`required	string
`key_prefix`required	string
`scopes`required	string[]
`kind`required	"standard" \| "agent"
`status`required	"active" \| "revoked"
`environment`required	"sandbox" \| "production"
`last_used_at`required	string<ISO-8601> \| null
`expires_at`required	string<ISO-8601> \| null
`created_at`required	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$
`revoked_at`required	string<ISO-8601> \| null
`secret`required	string

List

GET/v1/api-keys

Query

Field	Type	Notes
`limit`required	integer	Maximum number of items to return. Defaults to 20; maximum 100. range 1..100
`starting_after`	string	Opaque cursor from the previous response next_cursor.

Response

Field	Type	Notes
`object`required	"list"
`data`required	object[]
`has_more`required	boolean
`next_cursor`required	string \| null

Retrieve

GET/v1/api-keys/{'{api_key_id}'}

Response

Field	Type	Notes
`id`required	string
`object`required	"api_key"
`name`required	string
`key_prefix`required	string
`scopes`required	string[]
`kind`required	"standard" \| "agent"
`status`required	"active" \| "revoked"
`environment`required	"sandbox" \| "production"
`last_used_at`required	string<ISO-8601> \| null
`expires_at`required	string<ISO-8601> \| null
`created_at`required	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$
`revoked_at`required	string<ISO-8601> \| null

Rename

PATCH/v1/api-keys/{'{api_key_id}'}

Request body

Field	Type	Notes
`name`required	string	len 3..80

Response

Field	Type	Notes
`id`required	string
`object`required	"api_key"
`name`required	string
`key_prefix`required	string
`scopes`required	string[]
`kind`required	"standard" \| "agent"
`status`required	"active" \| "revoked"
`environment`required	"sandbox" \| "production"
`last_used_at`required	string<ISO-8601> \| null
`expires_at`required	string<ISO-8601> \| null
`created_at`required	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$
`revoked_at`required	string<ISO-8601> \| null

Rotate

POST/v1/api-keys/{'{api_key_id}'}/rotate

Rotation returns the new secret once and invalidates the previous secret hash. Update clients before revoking fallback keys.

Response

Field	Type	Notes
`id`required	string
`object`required	"api_key"
`name`required	string
`key_prefix`required	string
`scopes`required	string[]
`kind`required	"standard" \| "agent"
`status`required	"active" \| "revoked"
`environment`required	"sandbox" \| "production"
`last_used_at`required	string<ISO-8601> \| null
`expires_at`required	string<ISO-8601> \| null
`created_at`required	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$
`revoked_at`required	string<ISO-8601> \| null
`secret`required	string

Revoke

DELETE/v1/api-keys/{'{api_key_id}'}

Revocation is idempotent. Already revoked keys return their existing revoked state.

Response

Field	Type	Notes
`id`required	string
`object`required	"api_key"
`name`required	string
`key_prefix`required	string
`scopes`required	string[]
`kind`required	"standard" \| "agent"
`status`required	"active" \| "revoked"
`environment`required	"sandbox" \| "production"
`last_used_at`required	string<ISO-8601> \| null
`expires_at`required	string<ISO-8601> \| null
`created_at`required	string<ISO-8601>	pattern: ^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))T(?:(?:[01]\d\|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z\|([+-](?:[01]\d\|2[0-3]):[0-5]\d)))$
`revoked_at`required	string<ISO-8601> \| null

Environment binding

Sandbox keys can only access sandbox environments. Production keys can only access production environments. Cross-environment requests are rejected before business logic runs.

Scopes

Keys carry explicit scopes such as messages:write, templates:read, and webhooks:write. Create the narrowest key your integration needs.