Skip to content
StartupBuilderby Startups.Studio
Business
Changelog
ProductDomains and access

API Key

An API Key is a secret a Startup issues to one Customer, which signs that Customer’s calls to its API, SDK, CLI and MCP server.

Properties

PropertyTypeRequiredDescription
namestringrequiredWhat the Customer calls it, so a list of keys reads by purpose.
environmentstringrequiredOne of test or live: a test key reaches test records and moves no money.
verbslist of VerbThe Verbs it may call. Unset: every Verb the Customer’s Entitlements grant.
prefixstringThe first characters of the secret, shown in place of it everywhere after issue.
lastUsedAtdatetimeWhen it last signed a call.
expiresAtdatetimeWhen it stops working on its own. Unset: it works until rolled or revoked.
revokedAtdatetimeWhen it was revoked. A revoked key fails its next call.

Object

JSON
{
  "$id": "https://api.sb/petpantry.shop/api-keys/api_key_1",
  "$type": "APIKey",
  "name": "Nightly sync",
  "environment": "test",
  "verbs": [
    "verb_1"
  ],
  "prefix": "sk_live_4f2a",
  "lastUsedAt": "2026-10-22T12:00:00Z",
  "expiresAt": "2026-10-22T12:00:00Z",
  "revokedAt": "2026-10-22T12:00:00Z"
}

Relationships

  • An API Key reaches one Tenant: every call it signs reads and writes only that Customer’s records. reaches, inverse apiKeys.

Verbs

  1. getReturns one API Key by id.
    GET /{namespace}/api-keys/{id}readNo Event
  2. listReturns API Keys, newest first, one page at a time.
    GET /{namespace}/api-keysreadNo Event
  3. issueIssue creates an API Key for one Customer and returns its secret once; afterwards only the prefix shows.
    POST /{namespace}/api-keys/issuedoAPIKey.issued
  4. revokeRevoke stops an API Key at once: its next call fails with 401, and the record and its history stay.
    POST /{namespace}/api-keys/{apiKey}/revokedoAPIKey.revoked
  5. rollRoll issues a replacement API Key with the same scope and keeps the old one working until a set time.
    POST /{namespace}/api-keys/{apiKey}/rolldoAPIKey.rolled

An API Key is kept forever and never edited: it has no update or delete.

Permissions

Which Access level may call each Verb. One-way Verbs wait their delay window.

Operationowneradminmemberviewer
APIKey.getYesYesYesYes
APIKey.listYesYesYesYes
APIKey.issueYesYesYesNo
APIKey.revokeYesYesYesNo
APIKey.rollYesYesYesNo

Call it

Text
Issue the API key “Nightly sync” with a customer.

Example

Leaseline sells renewal dates through its API. A property manager's admin issues a live key named Nightly sync that may call only Collection.query, and the Portal shows it as leaseline_sk_live_4f2a. When the key turns up in a public repository, it is revoked within minutes and the admins get an email to roll a replacement.

Domains and access

Previous Page

APIKey.get

Next Page