Create an API key
Mints a new `sk-` API key for the authenticated user and returns the plaintext exactly once. The caller is expected to copy the key immediately; the store only keeps the SHA-256 hash, the display prefix, and the last four characters, and the API has no way to recover the plaintext afterwards. The key authenticates the `/mcp` endpoint: any MCP client can call it with `Authorization: Bearer <key>`. Revoke a key to invalidate it instantly; new requests with that key return 401.
Mints a new sk- API key for the authenticated user and returns the plaintext exactly once. The caller is expected to copy the key immediately; the store only keeps the SHA-256 hash, the display prefix, and the last four characters, and the API has no way to recover the plaintext afterwards. The key authenticates the /mcp endpoint: any MCP client can call it with Authorization: Bearer <key>. Revoke a key to invalidate it instantly; new requests with that key return 401.
Authorization
bearerAuth A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.
In: header
Request Body
application/json
The label to give the new key.
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/account/api-keys" \ -H "Content-Type: application/json" \ -d '{ "name": "string" }'{ "id": "string", "name": "string", "prefix": "string", "last4": "stri", "status": "active", "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z", "key": "string"}List the caller's API keys GET
Returns every API key the authenticated user owns, including revoked ones. The plaintext is never included; only the id, label, prefix, last four, status, and timestamps.
Revoke an API key DELETE
Soft-deletes the key: the row stays so the audit trail is intact, but the SHA-256 hash is dropped from the verify index, so every future MCP request that presents the key receives 401. The endpoint returns 404 when the key does not exist or is owned by a different user; it does not differentiate, so it cannot be used to probe other users' key ids.