API Key Management

Manage your API keys programmatically. All endpoints require Firebase authentication (browser session).

POST /api/v1/api-keys

Create a new API key. The full key is returned only once — store it securely.

Request body

{
  "name": "My production app",
  "expiresAt": 1735689600000  // optional, Unix ms
}

Response

{
  "key": "sk-tm-a1b2c3d4...",
  "keyId": "a1b2c3d4e5f6...",
  "keyPrefix": "sk-tm-a1b2..."
}

GET /api/v1/api-keys

List all API keys for the authenticated user. Returns metadata only (prefix, name, dates) — never the full key.

Response

[
  {
    "keyId": "a1b2c3d4...",
    "keyPrefix": "sk-tm-a1b2...",
    "name": "My production app",
    "createdAt": 1700000000000,
    "lastUsedAt": 1700001000000,
    "expiresAt": null,
    "revokedAt": null
  }
]

DELETE /api/v1/api-keys/{keyId}

Revoke a specific API key. The key is soft-deleted for audit trail — it will appear in listings with a revokedAt timestamp.