API keys

All three endpoints need a signed-in session; an API key cannot manage keys. See Authentication.

Endpoint	What it does
GET /api-keys	The account’s keys, as apiKeys: id, sealed meta naming it, hint (the last four characters), createdAt and lastUsedAt.
POST /api-keys	Create a key. Send an id of the form key_… and a sealed meta. Returns apiKey and its token, which is shown only this once. Operator plan and up (403 plan_required below it); 20 keys per account (409 limit_reached past that).
DELETE /api-keys/:id	Revoke a key. Anything using it gets 401 from then on.

{
  "apiKey": {
    "id": "key_4hq8s2ma9x",
    "hint": "x7Qa",
    "meta": { "…": "sealed" },
    "createdAt": "2026-09-18T10:02:11.000Z",
    "lastUsedAt": null
  },
  "token": "mak_…"
}

lastUsedAt is the last time the key was used, rounded down to five minutes, and null until it is. It says that the key was used, never what for. See Usage for what the account has spent against its plan.