---
title: API Keys
description: List, mint, and revoke keys.
---

All key management requires a valid signed session token: `Authorization: Bearer <session token>`. API keys cannot list, mint, or revoke keys. The authenticated user is the owner of every key created through these endpoints.

### GET /account/keys

**Response — `200`**

```json
{
  "keys": [
    {
      "id": "key_01j8xq2v9…",
      "name": "trading-agent",
      "prefix": "st_live_4f2a9c…",
      "created_at": "2026-07-28T09:12:00Z",
      "last_used_at": "2026-07-28T11:03:41Z",
      "requests_today": 1240
    }
  ]
}
```

The secret is never returned — only the display `prefix`.

### POST /account/keys

Mints an additional key (rotation, one key per bot, one per environment).

**Request**

```json
{ "name": "backtest-runner" }
```

`name` is optional and defaults to `api-key` when omitted or blank.

**Response — `201`**

```json
{
  "api_key": "st_live_…",
  "key_id": "key_01j8xq2v9…",
  "account_id": "acct_01j8xq2v9…"
}
```

The new `api_key` appears only in this response. Store it before making another request.

Names are fixed at mint — there's no rename; a key with the wrong name is one rotation away from a right one.

### DELETE /account/keys/:id

Revokes the key. Takes effect within seconds; in-flight requests complete. Running deployments are **not** stopped — they authenticate internally once created — so revoking a leaked key never kills your live strategy.

**Response — `200`**

```json
{ "status": "revoked" }
```

## Rotation without downtime

1. `POST /account/keys` — mint the replacement.
2. Move your agent/config to the new key.
3. `DELETE /account/keys/:old` — revoke the old one.

There is no step where anything stops running.