API Keys

POST /v1/auth/keys creates a programmatic key. The raw token is returned only once; store it in a secret manager or environment variable immediately. All fields are optional: label, scopes (defaults to a curated external-developer scope set derived from your identity), spendLimitMicros, and expiresAt.

const created = await client.authKeys.create({
  label: "ci-runner",
  scopes: ["model:invoke", "usage:read"],
});
console.log(created.token); // the full secret — shown once

client.authKeys.list() (GET /v1/auth/keys) lists the keys you own. client.authKeys.revoke(keyId) (DELETE /v1/auth/keys/{keyId}) revokes one. Revoke any key you suspect is leaked.

const keys = await client.authKeys.list();
await client.authKeys.revoke(created.key!.keyId!);

The same create call without the SDK:

curl https://seachat.ai/v1/auth/keys \
  -H "Authorization: Bearer $SEACHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"ci-runner","scopes":["model:invoke","usage:read"]}'