Docs/API keys

API keys

Manage team-scoped API keys programmatically or from the dashboard. Keys authenticate with the Authorization: Bearer header.

Create a key

POST/keys

Generates a new key for a team and environment. The response includes the plaintext secret — store it immediately, since it can't be retrieved again.

Field	Description
`teamId`	The UUID of the team this key belongs to.
`name`	A human-readable label for the key, shown in the dashboard.
`env`	The environment the key is scoped to: `live` or `test`.
`expiresAt`	Optional. ISO 8601 date-time after which the key stops working. Omit for a key that never expires.

curl -X POST https://api.seeitlive.io/v1/keys \
  -H "Authorization: Bearer <dashboard-jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "teamId": "<uuid>", "name": "Server key", "env": "live" }'

json

{
  "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
  "name": "Server key",
  "env": "live",
  "prefix": "sil_live_ab12cd",
  "secret": "sil_live_ab12cdxxxxxxxxxxxxxxxxxxxxxxxx"
}

Shown once

The secret field is returned only on creation and never again.

Creating and revoking keys requires the manage_keys permission on the team; listing keys only requires view_team.

List keys

GET/keys?teamId=<uuid>

Returns the active (non-revoked) keys for a team. The secret is never included — only the prefix, which is enough to identify a key in the dashboard or logs.

json

[
  {
    "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
    "name": "Server key",
    "env": "live",
    "prefix": "sil_live_ab12cd",
    "lastUsedAt": "2026-07-01T12:03:44.000Z",
    "createdAt": "2026-06-15T09:12:00.000Z"
  }
]

Update a key

PATCH/keys/:id

Partially updates a key. Only the fields you include are changed; omitted fields are left as-is.

Field	Description
`name`	A new label for the key.
`allowedIps`	The unified allowed-sources list: IPs, CIDR ranges, or hostnames, one per array entry. Replaces the existing list.
`expiresAt`	ISO 8601 date-time, or `null` to clear an existing expiry.

curl -X PATCH https://api.seeitlive.io/v1/keys/d290f1ee-6c54-4b01-90e6-d701748f0851 \
  -H "Authorization: Bearer <dashboard-jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "allowedIps": ["10.0.0.0/8 # office VPN"], "expiresAt": "2026-12-31T00:00:00.000Z" }'

json

{
  "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
  "name": "Server key",
  "env": "live",
  "prefix": "sil_live_ab12cd",
  "allowedIps": ["10.0.0.0/8 # office VPN"],
  "expiresAt": "2026-12-31T00:00:00.000Z",
  "lastUsedAt": "2026-07-01T12:03:44.000Z",
  "createdAt": "2026-06-15T09:12:00.000Z"
}

Revoke a key

DELETE/keys/:id

Immediately disables a key. In-flight requests using it start failing right away, and it stops appearing in the list response.

json

{ "ok": true }

Request signing

Signing adds HMAC verification on top of the bearer key. See the signing contract in the authentication guide for exactly how to compute and send the signature.

Enable signing

POST/keys/:id/signing/enable

Turns on signing for a key and returns the signing secret. The secret is shown once — store it immediately.

json

{ "signingSecret": "3fa1e2d0c9b84a5b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f7081920a3b4c5" }

Rotate the signing secret

POST/keys/:id/signing/rotate

Issues a new signing secret for a key, invalidating the previous one. Also shown once.

json

{ "signingSecret": "8c9d0e1f2a3b4c5d6e7f8091a2b3c4d53fa1e2d0c9b84a5b6e7f8091920a3b4c" }

Disable signing

POST/keys/:id/signing/disable

Turns off signing for a key. Requests to it no longer need a signature.

json

{ "ok": true }

Authentication Sessions