API keys
client.apiKeys manages tenant-scoped bearer credentials. An API key grants backend access to every resource in its Tenant; it is not an Agent ACL.
Overview
Create requires a name and accepts an optional offset-aware expiresAt. When expiresAt is absent, the key does not expire; when supplied, it must be in the future. The complete ba_ token is returned once; later responses contain only a short display fragment. No labels or arbitrary metadata are supported beyond name.
Methods
create()
create(body: { name: string; expiresAt?: string }): Promise<CreateApiKeyResponse> — POST /v1/apikeys. Save token immediately in backend secret storage.
list()
list(): Promise<ApiKeysResponse> — GET /v1/apikeys. Returns metadata and keyFragment, never the token.
delete()
delete(id: string): Promise<void> — DELETE /v1/apikeys/:id. Revocation is permanent; deploy a replacement before rotating.
Types
CreateApiKeyResponse is { apiKey, token }. apiKey contains ID, name, key fragment, creation time, and nullable expiry. See objects and schemas.
Errors
Invalid names, malformed expiry timestamps, and expiry timestamps that are not in the future return invalid_request; authentication failures are unauthorized. See errors.
Example
import { writeFile } from "node:fs/promises";
import { BlazingAgents } from "@blazing-agents/sdk";
const client = new BlazingAgents({ apiKey: process.env.BLAZING_AGENTS_API_KEY! });
const created = await client.apiKeys.create({ name: "Production backend" });
// Replace this local demonstration with your production secret manager.
await writeFile("./blazing-agents-api-key", created.token, { mode: 0o600 });
const keys = await client.apiKeys.list();
console.log(keys.apiKeys.map(({ id, keyFragment }) => ({ id, keyFragment })));
await client.apiKeys.delete(created.apiKey.id);