API Keys /api/keys

Manage keys used to call the /v1 gateway. All endpoints require a session token.

GET /api/keys

Lists all keys for the current account.

{
  "ok": true,
  "keys": [
    {
      "id": "3",
      "name": "production",
      "masked": "mf-abc1...ef9",
      "key": "mf-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
      "viewable": true,
      "lastUsedAt": "2026-10-16T09:12:00.000Z",
      "revoked": false,
      "createdAt": "2026-10-10T04:00:00.000Z"
    }
  ]
}

Field	Description
masked	Masked key for display; always available
key	Plaintext key; present only when viewable is true
viewable	Whether plaintext can be recovered. Keys created before this feature only have a hash and cannot be recovered

POST /api/keys

Creates a key and returns its plaintext value. Recoverable keys can also be retrieved later through the list endpoint.

Parameter	Type	Required	Description
name	string	No	Label, up to 60 characters; defaults to default

curl -X POST "https://modelfold.ai/api/keys" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"production"}'

{
  "ok": true,
  "key": "mf-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "record": { "id": "4", "name": "production", "masked": "mf-abc1...ef9", "revoked": false, "createdAt": "..." }
}

If the account already has 10 active keys, creation returns 400 too_many_keys.

DELETE /api/keys/:id

Revokes a key immediately. Gateway requests using it then return 401.

An unknown or already revoked key returns 404 not_found.

Key storage

• The database stores a SHA-256 hash for validation and an AES-256-GCM encrypted copy for display in the console.
• Searching database values for a plaintext key will not find it.
• Recoverable keys offer convenience at the cost of retaining encrypted key material. A deployment that disables recovery requires users to create a replacement whenever they lose a key.

See also

• Authentication
• Gateway