Skip to main content

API Keys - TypeScript SDK

client.keys manages API keys used to authenticate clients. Revealed plaintext values are secrets and must never be logged.

Overview​

Available Operations​

MethodDescription
list(options?)List visible API keys; admin callers may filter by owner.
create(body)Create an API key.
reveal(id)Reveal plaintext when policy permits.
update(id, body)Update description, active state, or expiration.
delete(id)Delete an API key.

list​

List visible API keys; admin callers may filter by owner.

Request​

Optional {ownerId}.

Response​

ApiKeyResponse[].

create​

Create an API key.

Request​

Required keyValue; optional description, isActive, and expiresAt. The caller generates the key value.

Response​

ApiKeyResponse; may include one-time plaintextKey.

reveal​

Reveal plaintext when policy permits.

Request​

String id required.

Response​

string.

update​

Update description, active state, or expiration.

Request​

String id and body required.

Response​

Updated ApiKeyResponse.

delete​

Delete an API key.

Request​

String id required.

Response​

boolean.

Field Reference and Examples​

The body supports id, keyValue, isActive, description, expiresAt, and createdBy. The caller must generate and submit keyValue; normal callers should not set ownership fields. ApiKeyResponse contains id, isActive, description, expiresAt, createdBy, userId, masked keyValue, and possibly one-time plaintextKey.

The response id is numeric while follow-up key-management methods accept a string; convert it with String(...).

const keys = await client.keys.list();
const created = await client.keys.create<{ id: number; plaintextKey?: string }>({
  keyValue: "sk-created-by-caller",
  description: "automation key",
  isActive: true,
});
const keyId = String(created.id);
const plaintext = created.plaintextKey ?? await client.keys.reveal<string>(keyId);
const updated = await client.keys.update(keyId, {
  description: "renamed key",
  isActive: true,
});
const deleted = await client.keys.delete<boolean>(keyId);

All methods use the shared authentication and typed error behavior described in Response Conventions and Retry and Security.