API Keys

Manage API keys for programmatic access.

⚠️ All API-key endpoints require the calling key to have the ADMIN permission. The easiest way to manage keys is the CLI: tokenbot apikey create | list | revoke.

Endpoints

Method	Path	Description
GET	/v1/api-keys	List API keys
POST	/v1/api-keys	Create API key
DELETE	/v1/api-keys/:id	Delete API key
POST	/v1/api-keys/:id/rotate	Rotate API key

---

List API Keys

GET /v1/api-keys

curl https://api.tokenbot.com/v1/api-keys \
  -H "X-API-Key: tb_live_your_key"

---

Create API Key

POST /v1/api-keys

Returns the full key only once — store it securely.

curl -X POST https://api.tokenbot.com/v1/api-keys \
  -H "X-API-Key: tb_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"name":"CI/CD Key"}'

---

Delete API Key

DELETE /v1/api-keys/:id

---

Rotate API Key

POST /v1/api-keys/:id/rotate

Generates a new key value. The old key is immediately invalidated.

curl -X POST https://api.tokenbot.com/v1/api-keys/key_abc123/rotate \
  -H "X-API-Key: tb_live_your_key"