# API Keys

Mint, list, and revoke user API keys through the /v1 auth facade.

## Mint a key

`POST /v1/auth/keys` creates a programmatic key. The raw `token` is returned only once; store it in a secret manager or environment variable immediately. All fields are optional: `label`, `scopes` (defaults to a curated external-developer scope set derived from your identity), `spendLimitMicros`, and `expiresAt`.

```bash
const created = await client.authKeys.create({
  label: "ci-runner",
  scopes: ["model:invoke", "usage:read"],
});
console.log(created.token); // the full secret — shown once
```

## List and revoke

`client.authKeys.list()` (`GET /v1/auth/keys`) lists the keys you own. `client.authKeys.revoke(keyId)` (`DELETE /v1/auth/keys/{keyId}`) revokes one. Revoke any key you suspect is leaked.

```bash
const keys = await client.authKeys.list();
await client.authKeys.revoke(created.key!.keyId!);
```

## Mint over curl

The same create call without the SDK:

```bash
curl https://seachat.ai/v1/auth/keys \
  -H "Authorization: Bearer $SEACHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"ci-runner","scopes":["model:invoke","usage:read"]}'
```