Claud
Get started

API keys

List, create, rotate and revoke the API keys on your account.

Session required for changes

Listing keys works with an API key. Creating, rotating or revoking keys requires a signed-in dashboard session (cookie plus CSRF token), so a leaked key can never mint replacements for itself. Calls from an API key receive 403 key_management_requires_session.

The key object#

JSON
{
  "id": "5d1c4c2e-...",
  "object": "api_key",
  "name": "production backend",
  "prefix": "sk-vh7vSQ",
  "status": "active",
  "created_at": "2026-09-15T17:30:00.000Z",
  "expires_at": null,
  "last_used_at": "2026-09-15T17:39:33.071Z",
  "revoked_at": null,
  "total_requests": 12840
}
prefixstring
The first characters of the key, for telling keys apart. The full key is only ever returned once, on creation or rotation.
statusstring
active, revoked or expired.
expires_atstring | null
Keys with an expiry stop authenticating at that instant and are marked expired.

List keys#

GET/v1/api-keys

Returns all keys on the account, including revoked and expired ones, as { "object": "list", "data": [...] }.

Create a key#

POST/v1/api-keys
namestringrequired
Label shown in the dashboard. 1–80 characters.
expires_atstring
ISO-8601 timestamp in the future.
expires_in_daysinteger
Alternative to expires_at; 1–3650 days.

Returns 201 with the key object plus a one-time key field containing the full sk-... secret. Store it immediately; it cannot be retrieved again. Your plan's max_api_keys limit applies to active keys, and at most 20 keys can be created per hour.

JSON
{
  "id": "5d1c4c2e-...",
  "object": "api_key",
  "name": "production backend",
  "prefix": "sk-vh7vSQ",
  "status": "active",
  "created_at": "2026-09-15T17:30:00.000Z",
  "expires_at": null,
  "last_used_at": null,
  "revoked_at": null,
  "total_requests": 0,
  "key": "sk-vh7vSQFEbcSHcqxg2spzjYhKCda6Kn1JUGhWIFwTaNevXQ7g"
}

Rotate a key#

POST/v1/api-keys/{id}/rotate

Creates a new key with the same name and expiry, revokes the old one, and returns the new key object with its one-time key field (201). Requests using the old key fail from that moment, so deploy the new secret first and rotate immediately after.

Revoke a key#

DELETE/v1/api-keys/{id}

Permanently disables the key and returns the key object with "deleted": true. Revocation takes effect immediately, including for in-flight streams that have not yet started.

Examples#

Because writes need a browser session, the practical way to manage keys programmatically is from a signed-in dashboard context. Reads work with any key:

curl https://api.claudkey.com/v1/api-keys \
  -H "Authorization: Bearer $CLAUD_API_KEY"

Key creation, rotation and revocation are recorded in your account's audit trail, and every newly issued key is confirmed by email to the account address.

Previous
Usage