The APIs the person may make API keys for
The brand's APIs whose tenant lets its users make API keys for them, with the scopes each defines, by name. Needs `me:read`.
/v1/apisThe brand's APIs whose tenant lets its users make API keys for them, with the scopes each defines, by name. Needs me:read.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/apis"{ "data": [ { "identifier": "string", "name": "string", "scopes": [ { "name": "string", "description": "string" } ] } ]}Make an API key POST
A key for one of the brand's APIs that lets its users make them (`GET /v1/apis`): `ak_live_…` in production, `ak_test_…` elsewhere, in this response only. It acts as the person, with the scopes given, until it is revoked or expires, or the API stops letting its users make keys. At most 25 live at once. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.api_key_created`.
Withdraw what the person allowed an app DELETE
The app's grants and tokens for them end, its refresh tokens included, and each session it was signed in to that registered a `backchannel_logout_uri` gets a logout token; their next sign-in to it asks again. Needs `me:write`. Recorded as `user.consent_revoked`.