API keys API

Create, list, inspect, rotate and revoke keys programmatically — everything the console does, without opening it.

An API key cannot manage API keys

These endpoints authenticate with your account session, not with an ak- key. Presenting an API key here is refused with 401. If one leaked key could enumerate, mint and revoke the others, the compromise of a single credential would become the compromise of all of them.

Endpoints

Method	Path	Success	Summary
`POST`	`/v1/api-keys`	`201`	Create an API key. The secret is returned exactly once.
`GET`	`/v1/api-keys`	`200`	List every key on the account. Metadata only — never a secret.
`GET`	`/v1/api-keys/{key_public_id}`	`200`	Inspect one key.
`POST`	`/v1/api-keys/{key_public_id}/rotate`	`200`	Replace the secret, keep the key's identity.
`DELETE`	`/v1/api-keys/{key_public_id}`	`200`	Revoke a key. Idempotent — revoking twice is a success.

Create a key

Returns 201. The response carries secret, secret_once: true and a warning — this is the only response that will ever contain the secret. Astrodyne keeps a one-way hash and cannot show it again.

curl

Python

JavaScript

Response fields

Field	Meaning
`id`	Opaque key id (`akey-…`). Stable across rotation — use this everywhere.
`label`	Your name for the key.
`prefix`	The leading characters of the secret, so you can tell keys apart. Shown only to you.
`status`	`active`, `expired`, or `revoked`.
`request_count`, `last_used_at`	Usage attribution for this key.
`spending_limit_usd`	Per-key cap, or `null`.
`model_allowlist`, `model_blocklist`	Per-key model policy.
`secret`	Create and rotate only. Never returned again.

Rotate and revoke

Rotation replaces the secret and keeps the key id, so usage history stays attached. The previous secret stops working the moment the call returns — deploy the new one first, then rotate.

Revocation is idempotent: a second DELETE is still a success, with changed: false.

curl

# Rotate: same key id, new secret. The old secret stops working now.
curl -X POST https://api.astrodyne.ai/v1/api-keys/akey-YOUR-KEY-ID/rotate \
  -H "Authorization: Bearer $ASTRODYNE_SESSION_TOKEN"

# Revoke. Idempotent — a second call is still a success.
curl -X DELETE https://api.astrodyne.ai/v1/api-keys/akey-YOUR-KEY-ID \
  -H "Authorization: Bearer $ASTRODYNE_SESSION_TOKEN"

Python

import os
import httpx

session = {"Authorization": f"Bearer {os.environ['ASTRODYNE_SESSION_TOKEN']}"}
key_id = "akey-YOUR-KEY-ID"

with httpx.Client(base_url="https://api.astrodyne.ai") as http:
    rotated = http.post(f"/v1/api-keys/{key_id}/rotate", headers=session)
    rotated.raise_for_status()
    body = rotated.json()

    # Same id, new secret: usage history stays attached to the key.
    assert body["id"] == key_id
    new_secret = body["secret"]

    # Deploy new_secret everywhere BEFORE this point — the previous secret
    # stopped working the moment the call above returned.

    # When you are finished with a key entirely:
    revoked = http.delete(f"/v1/api-keys/{key_id}", headers=session).json()
    print(revoked["status"], "changed:", revoked["changed"])

JavaScript

const session = { Authorization: `Bearer ${process.env.ASTRODYNE_SESSION_TOKEN}` };
const keyId = "akey-YOUR-KEY-ID";

const rotated = await (await fetch(
  `https://api.astrodyne.ai/v1/api-keys/${keyId}/rotate`,
  { method: "POST", headers: session },
)).json();

// Same id, new secret: usage history stays attached to the key.
console.log(rotated.id === keyId, rotated.secret_once);

// Deploy rotated.secret everywhere BEFORE this point — the previous secret
// stopped working the moment the call above returned.

const revoked = await (await fetch(
  `https://api.astrodyne.ai/v1/api-keys/${keyId}`,
  { method: "DELETE", headers: session },
)).json();
console.log(revoked.status, revoked.changed);

Revoking a key is not the same as losing access

Access to the API comes from your account's invite, not from any particular key. Revoking every key does not revoke your access, and losing access does not revoke your keys — they simply stop working until access is restored.

Failures

HTTP	code	When
401	`authentication_error`	No credential was presented, or the wrong kind was.
403	`beta_access_required`	Authenticated, but this account is not in the invite-only beta.
404	`api_key_not_found`	No such key on this account.
409	`api_key_revoked`	The key is revoked and cannot be rotated.

API-key security → Storing and rotating secrets safely. Usage API → Attribute spend to each key.