# API Key methods: issue, revoke, roll

URL: /code/sdk/api-key/verbs · Id: `page:code/sdk/api-key/verbs`

> The API Key Verbs issue, revoke, roll as typed SDK methods, with inputs, result, refusals and an example.

Reference for [API Key](/business/nouns/api-key), one group of [API Key methods](/code/sdk/api-key).

### APIKey.issue
Issue creates an API Key for one Customer and returns its secret once; afterwards only the prefix shows. [Verb page](/business/nouns/api-key/issue?interface=sdk).

```ts
interface APIKeyVerbs {
  issue(input: APIKeyIssueInput, options?: SB.CallOptions): SB.Call<APIKeyIssueOutput>
}
```

Emits [`APIKey.issued`](/business/events/APIKey.issued).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `customer` | [Customer](/business/nouns/customer) | Yes | The Customer whose calls it signs. |
| `name` | `string` | Yes | What the key is for. |
| `environment` | `string` | Yes | One of `test` or `live`. |
| `verbs` | list of [Verb](/business/nouns/verb) | No | The Verbs it may call; unset reaches every Verb the Customer’s Entitlements grant. |
| `expiresAt` | `datetime` | No | When it stops working on its own. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key, with its prefix. |
| `secret` | `string` | Yes | The full secret. It is returned here once and never again. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const { apiKey, secret } = await $.APIKey.issue({ customer: 'cus_wjAFWuKWIV', name: 'Nightly sync', environment: 'test' })
```

### APIKey.revoke
Revoke stops an API Key at once: its next call fails with 401, and the record and its history stay. [Verb page](/business/nouns/api-key/revoke?interface=sdk).

```ts
interface APIKeyVerbs {
  revoke(input: APIKeyRevokeInput, options?: SB.CallOptions): SB.Call<APIKey>
}
```

Emits [`APIKey.revoked`](/business/events/APIKey.revoked).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key to stop. |
| `reason` | `text` | No | Why, shown to the Customer’s admins. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key, with `revokedAt` set. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const apiKey = await $.APIKey.revoke({ apiKey: 'key_BG13nfhe26' })
```

### APIKey.roll
Roll issues a replacement API Key with the same scope and keeps the old one working until a set time. [Verb page](/business/nouns/api-key/roll?interface=sdk).

```ts
interface APIKeyVerbs {
  roll(input: APIKeyRollInput, options?: SB.CallOptions): SB.Call<APIKeyRollOutput>
}
```

Emits [`APIKey.rolled`](/business/events/APIKey.rolled).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key to replace. |
| `expireIn` | `string` | No | How long the old key keeps working, from `0h` to `7d`. Defaults to `24h`. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The replacement API Key. |
| `secret` | `string` | Yes | The replacement’s full secret, returned once. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```ts
import { $ } from 'startup-builder'

const { apiKey, secret } = await $.APIKey.roll({ apiKey: 'key_BG13nfhe26' })
```