Keys

Your API keys and agent-token signing keys. To rotate: issue the new key, move over to it, then revoke the old one.

Method	Path	Body	Response
GET	/v1/api-keys	—	{ apiKeys }
POST	/v1/api-keys	{ name?, expires_in_days? } (1–3650)	201 { apiKey } with key — the only time it is shown
DELETE	/v1/api-keys/{id}	—	204
GET	/v1/signing-keys	—	{ signingKeys }
POST	/v1/signing-keys	{ kid? } (default: the next k<n>; at most 64 characters of A-Z a-z 0-9 . _ -, else 400)	201 { signingKey: { kid, secret } } — the only time the secret is shown
DELETE	/v1/signing-keys/{kid}	—	204

• apiKey: { id, name, prefix, createdAt, lastUsedAt, expiresAt, revokedAt }; prefix is the key's first 16 characters, to tell keys apart. lastUsedAt is accurate to about a minute. signingKey in a list: { kid, createdAt, revokedAt }.
• A revoked API key stops working at once. A revoked signing key's tokens are refused at once on the worker that revoked it and within a minute on the others, and every agent socket that connected with one of its tokens is disconnected, and every dashboard session its launch token started ends.
• Your last active key of a kind can't be revoked (409 last_key); a kid that exists, revoked or not, is 409 kid_taken — kids are never reused.