API Keys

List, mint, and revoke keys.

All key management requires a valid signed session token: Authorization: Bearer <session token>. API keys cannot list, mint, or revoke keys. The authenticated user is the owner of every key created through these endpoints.

GET/account/keys

Response — 200

{
  "keys": [
    {
      "id": "key_01j8xq2v9…",
      "name": "trading-agent",
      "prefix": "st_live_4f2a9c…",
      "created_at": "2026-07-28T09:12:00Z",
      "last_used_at": "2026-07-28T11:03:41Z",
      "requests_today": 1240
    }
  ]
}

The secret is never returned — only the display prefix.

POST/account/keys

Mints an additional key (rotation, one key per bot, one per environment).

Request

{ "name": "backtest-runner" }

name is optional and defaults to api-key when omitted or blank.

Response — 201

{
  "api_key": "st_live_…",
  "key_id": "key_01j8xq2v9…",
  "account_id": "acct_01j8xq2v9…"
}

The new api_key appears only in this response. Store it before making another request.

Names are fixed at mint — there's no rename; a key with the wrong name is one rotation away from a right one.

DELETE/account/keys/:id

Revokes the key. Takes effect within seconds; in-flight requests complete. Running deployments are not stopped — they authenticate internally once created — so revoking a leaked key never kills your live strategy.

Response — 200

{ "status": "revoked" }

Rotation without downtime

1. POST /account/keys — mint the replacement.
2. Move your agent/config to the new key.
3. DELETE /account/keys/:old — revoke the old one.

There is no step where anything stops running.