API keys

Overview

API keys authenticate server-side applications to a Tenant. Use these endpoints to issue a credential, inventory active keys, or revoke one without exposing stored token material.

Endpoints

POST /v1/apikeys

Creates an API key. The full token is returned only in this response; store it immediately. A tenant can have at most five API keys.

Requires bearer authentication and Content-Type: application/json. There are no path or query parameters. The credential selects the Tenant ownership boundary; reads and mutations are restricted to resources owned by that Tenant.

Location	Field	Required	Description
Header	`Authorization`	yes	Tenant API key or dashboard Supabase JWT.

Body field	Type	Required	Description
`name`	string	yes	Display name, 1–80 characters
`expiresAt`	string	no	RFC 3339 expiration timestamp; omit for no expiration

{ "name": "Production backend", "expiresAt": "2026-10-08T10:00:00Z" }

Response

Returns 201 Created and { apiKey, token }. token is a ba_ token with a 40-character body. The record exposes only its short display fragment on later reads.

Response schema: createApiKeyResponseSchema.

{
  "apiKey": {
    "id": "ak_1234567890ABCDEF",
    "name": "Production backend",
    "keyFragment": "ba_01",
    "createdAt": "2026-07-10T10:00:00Z",
    "expiresAt": "2026-10-08T10:00:00Z"
  },
  "token": "ba_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcd"
}

Errors

400 invalid_request for invalid input or when the five-key cap is reached. Standard authentication and service errors also apply; see REST errors.

cURL

curl --request POST "$BLAZING_AGENTS_BASE_URL/v1/apikeys" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"name":"Production backend","expiresAt":"2026-10-08T10:00:00Z"}'

SDK: create. See Security and credentials and Build a multi-tenant application.

GET /v1/apikeys

Returns every API key record for the tenant. This bounded list is not paginated and never returns a token or digest.

Request

Requires bearer authentication. There are no path, query, header, or body parameters beyond Authorization. The credential selects the Tenant ownership boundary; reads and mutations are restricted to resources owned by that Tenant.

Location	Field	Required	Description
Header	`Authorization`	yes	Tenant API key or dashboard Supabase JWT.

Response

Returns 200 OK.

Response schema: apiKeysResponseSchema.

{
  "apiKeys": [
    {
      "id": "ak_1234567890ABCDEF",
      "name": "Production backend",
      "keyFragment": "ba_01",
      "createdAt": "2026-07-10T10:00:00Z",
      "expiresAt": "2026-10-08T10:00:00Z"
    }
  ]
}

Errors

Only standard authentication and service errors apply; see REST errors.

cURL

curl "$BLAZING_AGENTS_BASE_URL/v1/apikeys" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY"

SDK: list. See Security and credentials and Build a multi-tenant application.

DELETE /v1/apikeys/:id

Hard-deletes an API key. The credential stops authenticating on its next request.

Request

Requires bearer authentication. The credential selects the Tenant ownership boundary; reads and mutations are restricted to resources owned by that Tenant.

Location	Field	Required	Description
Header	`Authorization`	yes	Tenant API key or dashboard Supabase JWT.
Path	`id`	yes	API key record ID (`ak_…`).

Path parameter	Type	Description
`id`	string	API key record ID (`ak_…`)

There is no query string or request body.

curl --request DELETE \
  "$BLAZING_AGENTS_BASE_URL/v1/apikeys/ak_1234567890ABCDEF" \
  --header "Authorization: Bearer $BLAZING_AGENTS_API_KEY"

SDK: delete. See Security and credentials and Build a multi-tenant application.

On this page