Create

POST /api/v1/me/api-keys

Body: {"name": "my-agent"}

The plaintext api_key is returned only once. Give each key a clear name like github-actions or claude-code so you know what it is later.

List

GET /api/v1/me/api-keys

Returns key status including is_active and revoked_at.

Revoke

POST /api/v1/me/api-keys/{key_id}/revoke

Revocation takes effect immediately. The record stays.

Disable / Enable

POST /api/v1/me/api-keys/{key_id}/status

Body: {"is_active": false}

You can temporarily disable a key instead of revoking it. Disabled credentials return 401; enabling the key restores it immediately. A revoked key cannot change status.

Admins can also disable a single key or the whole user's API access. Disabled credentials do not affect web login.