API keys

All three endpoints need a signed-in session; an API key cannot manage keys. See Authentication.

Endpoint	What it does
GET /api-keys	The account’s keys: id, sealed meta naming it, hint (the last four characters) and createdAt.
POST /api-keys	Create a key. Send an id of the form key_… and a sealed meta. Returns apiKey and its token, which is shown only this once. Operator plan and up; 20 keys per account.
DELETE /api-keys/:id	Revoke a key. Anything using it gets 401 from then on.

{
  "apiKey": { "id": "key_4hq8s2ma9x", "hint": "x7Qa", "meta": { "…": "sealed" }, "createdAt": "2026-09-18T10:02:11.000Z" },
  "token": "mak_…"
}