Revoke an API key
Soft-deletes the key: the row stays so the audit trail is intact, but the SHA-256 hash is dropped from the verify index, so every future MCP request that presents the key receives 401. The endpoint returns 404 when the key does not exist or is owned by a different user; it does not differentiate, so it cannot be used to probe other users' key ids.
Soft-deletes the key: the row stays so the audit trail is intact, but the SHA-256 hash is dropped from the verify index, so every future MCP request that presents the key receives 401. The endpoint returns 404 when the key does not exist or is owned by a different user; it does not differentiate, so it cannot be used to probe other users' key ids.
Authorization
bearerAuth A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.
In: header
Path Parameters
The id of the key to revoke.
1 <= lengthResponse Body
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/account/api-keys/string"Create an API key POST
Mints a new `sk-` API key for the authenticated user and returns the plaintext exactly once. The caller is expected to copy the key immediately; the store only keeps the SHA-256 hash, the display prefix, and the last four characters, and the API has no way to recover the plaintext afterwards. The key authenticates the `/mcp` endpoint: any MCP client can call it with `Authorization: Bearer <key>`. Revoke a key to invalidate it instantly; new requests with that key return 401.
Read the caller's profile GET
Returns the per-caller profile: the visitor's display name and the chosen Putty brand avatar. Both fields are nullable; a fresh visitor has not set them yet, and the Settings page renders an empty form in that case.