Keys

Package account is your own account: API keys you mint and revoke, and org onboarding.

keys

GET /v1/keys

Returns the caller's own API keys — every type they hold, read AUTHORITATIVELY from IAM rather than from the session claim, which lags a key minted moments ago. No secret material comes back: a secret key is represented by its prefix, and only a publishable key (public by construction) carries its full value.

A transient IAM read failure reports an empty set rather than a 5xx, so the page shows the honest empty state and never a fabricated key.

POST /v1/keys

Creates — or rotates — the caller's API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.

Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make "revoke my key" a lie.

Request body — application/json (required)

DELETE /v1/keys

Revokes the caller's own API key of the requested class. The class is the same field mint takes — ?type=publishable, defaulting to secret — so revoking the key that ships in a browser bundle does not sign its holder out of their own API: the other key keeps working.

Revoking is how a key is replaced when it does not need replacing; minting the same class again rotates it in one step. IAM drops the credential immediately, but the gateway caches keys for a few minutes, so a request that beat the cache expiry may still be served.

For callers written against the older shape, the class is also accepted in a JSON request body, read only when ?type= is absent.

---

All Hanzo APIs · Interactive reference