List the caller's API keys
Returns every API key the authenticated user owns, including revoked ones. The plaintext is never included; only the id, label, prefix, last four, status, and timestamps.
Returns every API key the authenticated user owns, including revoked ones. The plaintext is never included; only the id, label, prefix, last four, status, and timestamps.
Authorization
bearerAuth A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.
In: header
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/account/api-keys"{ "keys": [ { "id": "string", "name": "string", "prefix": "string", "last4": "stri", "status": "active", "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z" } ]}verify_contract
Verify a contract and get one label. Runs all seven putty checks — template match, static analysis, permission diff, hook permission read, tests + fork, invariants, plain-English readback — and returns the report, the label, and what the label means. FREE, and it spends nothing: this tool never touches the credit ledger, because a deterministic security check is included in every deploy and safety is not an upsell. Send `chain` and `abi`; every other field unlocks a check that otherwise SKIPS, and a skip is reported as `skipped` with a reason rather than as a pass. `clearedForMainnet` is always `false` — no putty report, of any label, is an external audit. The paid AI review is NOT this tool and is not exposed to MCP at all: a tool that spends credits has to go through the run approval path, and this one does not need to.
Create an API key POST
Mints a new `sk-` API key for the authenticated user and returns the plaintext exactly once. The caller is expected to copy the key immediately; the store only keeps the SHA-256 hash, the display prefix, and the last four characters, and the API has no way to recover the plaintext afterwards. The key authenticates the `/mcp` endpoint: any MCP client can call it with `Authorization: Bearer <key>`. Revoke a key to invalidate it instantly; new requests with that key return 401.