Create a user-linked API key pair

Production

POST

/v1/api-keys

Creates a public + secret API key pair bound to the authenticated user. The secret key value is returned only in this response; Vortex stores a hash and cannot show it again.

Keys expire after one year by default; expiresAt may extend this to at most two years from now. A user may hold at most 10 active keys (a pair counts as two).

Sandbox mints pk_test_*/sk_test_*; production mints pk_live_*/sk_live_*.

Auth: requires Authorization: Bearer <Supabase JWT> obtained from POST /v1/auth/verify-otp. Partner sk_*/pk_* keys are not accepted.

Request

Body Params application/json

Examples

Responses

🟢201

application/json

Key pair created. Persist secretKey.key immediately; it cannot be retrieved again.

Bodyapplication/json

🟠400

🟠401

🟠409

🔴500

Request Example

Shell

JavaScript

Java

Swift

curl --location '/v1/api-keys' \
--header 'Content-Type: application/json' \
--data '{
    "expiresAt": "2027-07-06T00:00:00.000Z",
    "name": "my-backend"
}'

Response Example

201 - Example 1

{
    "createdAt": "2019-08-24T14:15:22.123Z",
    "expiresAt": "2019-08-24T14:15:22.123Z",
    "isActive": true,
    "publicKey": {
        "id": "string",
        "key": "string",
        "keyPrefix": "string",
        "name": "string",
        "type": "public"
    },
    "secretKey": {
        "id": "string",
        "key": "string",
        "keyPrefix": "string",
        "name": "string",
        "type": "public"
    }
}

Modified at 2026-07-06 17:49:40

List the user's API keys

Revoke an API key