Docs/Account/API/API Keys

API Keys API

Create and manage API keys for programmatic (machine-to-machine) access. API keys are scoped per tenant and carry the same permission model as user tokens.

Base URL: https://id.vyntech.com.au/api/v1 — Requires api-keys:manage permission. API keys use the Authorization: Bearer vyn_key_... format for authentication.

Returns all API keys for the current tenant. The key value is only shown once at creation time — this endpoint returns masked keys.

API KeysAuth

List all API keys in the current tenant.

Status Codes

Name
200
Type
HTTP
Description
API keys list returned
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing api-keys:manage permission

Request

GET/api/v1/api-keys

Response 200

Creates a new API key. The full key value is returned only in this response — store it securely. You cannot retrieve it again. Optionally set an expiration date and specific permissions.

API KeyAuth

Create a new API key.

Payload Example

{
  "name": "Production Backend",
  "permissions": ["users:read", "sessions:read", "authz:check"],
  "expires_at": "2025-12-31T23:59:59Z"
}

Status Codes

Name
201
Type
HTTP
Description
API key created — full key returned (store securely)
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing api-keys:manage permission
Name
422
Type
HTTP
Description
Invalid permissions or expiry date

Security warning: The full API key is only returned once in this response. Store it in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.). If lost, revoke and create a new one.

Request

POST/api/v1/api-keys

Response 201

Permanently revokes an API key. Any requests using this key will immediately receive 401. This action is irreversible.

API KeyAuth

Revoke (delete) an API key.

Status Codes

Name
200
Type
HTTP
Description
API key revoked
Name
401
Type
HTTP
Description
Invalid or expired access token
Name
403
Type
HTTP
Description
Missing api-keys:manage permission
Name
404
Type
HTTP
Description
API key not found

Request

DELETE/api/v1/api-keys/:id

Response 200

What's Next

Settings API →

Configure tenant settings, password policies, and session limits.

Public Endpoints →

Branding, password policy, OIDC discovery, and JWKS.

Authentication API →

Roles & Permissions API →

Manage roles and authorization checks.