API Keys

Programmatic API key management

📄️ List API keys

Returns a paginated list of the store's API keys. The plaintext key is never included; only the key prefix and last four digits are shown. Requires the `canAccessApiKeys` plan feature.

📄️ Create an API key

Creates a new API key scoped to the store. The plaintext key is returned ONLY in this response (and on rotate) and can never be retrieved again - store it securely. Requires the `canAccessApiKeys` plan feature.

📄️ Get API key statistics

Returns aggregate counts (total, active, revoked, expired) and recent usage for all API keys of the store.

📄️ Get an API key

Returns full details of a single API key (without the plaintext key) plus usage statistics for today, the last 7 days and the last 30 days.

📄️ Update an API key

Updates mutable properties of an API key (name, description, scopes, expiry, IP whitelist, usage limit, active flag). At least one field is required. The key material itself never changes - use rotate for that.

📄️ Delete an API key

Permanently deletes an API key. This cannot be undone.

📄️ Revoke an API key

Revokes an API key so it can no longer authenticate. Revocation is recorded with the acting user, timestamp and an optional reason.

📄️ Rotate an API key

Creates a replacement key with the same scopes and either revokes the old key immediately (default) or keeps it usable until `gracePeriodExpiresAt`. The new plaintext key is returned ONLY in this response and can never be retrieved again.