Skip to main content
Personal API keys authenticate MCP clients and REST automation. Every user can manage their own keys through these three endpoints. Keys carry their creator’s current roles and attributes by reference, so a role change takes effect on the next request without rotating the key. When public demo credentials are enabled, keys created by the displayed account default to 24 hours and cannot request a longer lifetime.

​
POST /keys

Create a personal API key. The full token is returned exactly once in the response.
​
string
required
Human-readable label for the key.
​
string (Go duration)
Optional lifetime, for example "720h" for 30 days. Omit for a non-expiring key. Must be a positive Go duration.
​
string
Stable identifier for the key.
​
string
The name you assigned.
​
string
The user the key acts as.
​
string
The full lsk_... token. Returned only in this response.
The token is shown once and cannot be retrieved again. Save it now.

​
GET /keys

List all keys visible to the caller, including expired and revoked keys. Administrators see every user’s keys.
​
array
Key metadata: id, name, username, created_at, and optional expires_at, last_used_at, and revoked_at. The token itself is never returned.

​
DELETE /keys/

Revoke a key immediately. Non-admin callers can only revoke their own keys.
API keys act as their creator. Adjusting the creator’s roles or attributes changes what every one of their keys can do, without rotation.