API key endpoints

Generate, list, and revoke keys.

Endpoints

Method	Path	Description
POST	/api-keys	Generate new API key
GET	/api-keys	List API keys (prefix only)
DELETE	/api-keys/:id	Revoke API key

These three are dashboard-only. They require a signed-in dashboard session; calling them with an API key returns 403 FORBIDDEN. A key cannot mint or revoke another key — key management stays where a human is authenticated.

Reference

POST/api-keys

Mint a new API key. The secret is returned exactly once, in this response.

Success: 201 Created

key is the only field that never appears again — Outvo stores a hash, not the secret. Lose it and the only remedy is revoking the key and minting another. rateLimit is the per-minute request budget the key carries.

Body

Field	Type	Description
namereq	string	A label for you, 1-100 characters. It has no effect on what the key can reach.

Request

json

POST /api-keys
{ "name": "Production automation" }

Response

json

201 Created

{
  "data": {
    "id": "1f2e3d4c-...",
    "userId": "...",
    "keyPrefix": "pc_live_",
    "name": "Production automation",
    "rateLimit": 100,
    "createdAt": "2026-08-13T12:00:00.000Z",
    "key": "pc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  }
}

Errors

Code	HTTP	When
FORBIDDEN	403	Called with an API key instead of a dashboard session.
PLAN_LIMIT_REACHED	403	Your plan does not include API keys. Upgrade to Pro or higher.
VALIDATION_ERROR	400	Missing name, or name outside 1-100 characters.

GET/api-keys

List your active keys, newest first. Revoked keys are excluded.

Success: 200 OK

No key field here, by design. lastUsedAt is omitted for a key that has never authenticated a request — that is how you find keys worth revoking.

Response

json

200 OK

{
  "data": [
    {
      "id": "1f2e3d4c-...",
      "keyPrefix": "pc_live_",
      "name": "Production automation",
      "rateLimit": 100,
      "lastUsedAt": "2026-08-13T11:58:00.000Z",
      "createdAt": "2026-08-01T09:00:00.000Z"
    }
  ]
}

Errors

Code	HTTP	When
FORBIDDEN	403	Called with an API key instead of a dashboard session.

DELETE/api-keys/:id

Revoke a key. It stops authenticating immediately and disappears from the list.

Success: 204 No Content

Path parameters

Field	Type	Description
idreq	string (uuid)	API key id — not the key itself.

Errors

Code	HTTP	When
FORBIDDEN	403	Called with an API key instead of a dashboard session.
API_KEY_NOT_FOUND	404	Unknown id, not yours, or already revoked.