# API: API keys

| Method | Path | What it does | Scope |
|---|---|---|---|
| GET | `/v1/api-keys` | List API keys (secrets are never returned) | `keys:write` |
| POST | `/v1/api-keys` | Create an API key. The secret is shown once in this response. (web app only) | `keys:write` |
| DELETE | `/v1/api-keys/:id` | Revoke an API key | `keys:write` |
| PATCH | `/v1/api-keys/:id` | Change a key's name, address ranges or expiry (from now, at most 365 days; never expiring: owners, with a reason) (web app only) | `keys:write` |
| POST | `/v1/api-keys/:id/roll` | Replace a key's secret. The old secret stops working immediately; the new one is shown once. (web app only) | `keys:write` |

## Examples

### GET /v1/api-keys

List API keys (secrets are never returned)

```bash
curl -s "https://api.closefinch.com/v1/api-keys" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/api-keys`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### DELETE /v1/api-keys/$ID

Revoke an API key

```bash
curl -s -X DELETE "https://api.closefinch.com/v1/api-keys/$ID" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/api-keys/${id}`, {
  method: "DELETE",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

Request and response schemas: [https://www.closefinch.com/openapi.json](https://www.closefinch.com/openapi.json). All resources: [API reference](https://www.closefinch.com/docs/api).