API Keys

API keys are managed on the admin surface. The current handler supports listing, creating, and revoking keys for a tenant. Keys are one-time-reveal: the plaintext is returned only by the create endpoint and cannot be retrieved later — a lost key must be revoked and re-created.

Create a key

bash

POST /v1/admin/tenants/{tenant}/apikeys
Authorization: Bearer $JWT
Content-Type: application/json

{
  "name": "integration-paywall",
  "role": "paywall",
  "ttl_seconds": 3600
}

Supported roles

read
paywall
write
admin

Revoke a key

bash

POST /v1/admin/tenants/{tenant}/apikeys/{id}/revoke
Authorization: Bearer $JWT