The signed-in person's API keys
Oldest first, revoked and expired ones too; never a key itself. Needs `me:read`.
/v1/api-keysOldest first, revoked and expired ones too; never a key itself. Needs me:read.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/api-keys"{ "data": [ { "id": "string", "name": "string", "prefix": "string", "api": { "identifier": "string", "name": "string" }, "scopes": [ "string" ], "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z" } ]}Revoke an API key DELETE
At once: its API's next check of it answers `active: false`. Needs `me:write`. Recorded as `user.api_key_revoked`.
Make an API key POST
A key for one of the brand's APIs that lets its users make them (`GET /v1/apis`): `ak_live_…` in production, `ak_test_…` elsewhere, in this response only. It acts as the person, with the scopes given, until it is revoked or expires, or the API stops letting its users make keys. At most 25 live at once. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.api_key_created`.