API Keys

List, mint, rename, and revoke keys.

All key management authenticates with an existing key (x-api-key header, like every endpoint) or a Terminal session. A key can manage its sibling keys — including revoking itself. requests_today and all usage counters reset at 00:00 UTC.

GET/account/keys

Response — 200

{
  "keys": [
    {
      "id": "key_01j8xq2v9…",
      "name": "trading-agent",
      "prefix": "st_live_4f2a9c…",
      "created_at": "2026-07-28T09:12:00Z",
      "last_used_at": "2026-07-28T11:03:41Z",
      "requests_today": 1240
    }
  ]
}

The secret is never returned — only the display prefix.

POST/account/keys

Mints an additional key (rotation, one key per bot, one per environment).

Request

{ "name": "backtest-runner" }

Response — 201 — same shape as verify: the new api_key appears once.

Names are fixed at mint — there's no rename; a key with the wrong name is one rotation away from a right one.

DELETE/account/keys/:id

Revokes the key. Takes effect within seconds; in-flight requests complete. Running deployments are not stopped — they authenticate internally once created — so revoking a leaked key never kills your live strategy.

Response — 200

{ "status": "revoked" }

Rotation without downtime

1. POST /account/keys — mint the replacement.
2. Move your agent/config to the new key.
3. DELETE /account/keys/:old — revoke the old one.

There is no step where anything stops running.