Docs/Account/API/API Keys

API Keys API

Create and manage API keys for programmatic (machine-to-machine) access. API keys are scoped per tenant and carry the same permission model as user tokens.

Base URL: https://id.vyntech.com.au/api/v1 — Requires api-keys:manage permission. API keys use the Authorization: Bearer vyn_key_... format for authentication.

List API Keys

Returns all API keys for the current tenant. The key value is only shown once at creation time — this endpoint returns masked keys.

GET/api/v1/api-keys🔒 Auth

List all API keys in the current tenant.

curl https://id.vyntech.com.au/api/v1/api-keys \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

Create API Key

Creates a new API key. The full key value is returned only in this response — store it securely. You cannot retrieve it again. Optionally set an expiration date and specific permissions.

POST/api/v1/api-keys🔒 Auth

Create a new API key.

curl -X POST https://id.vyntech.com.au/api/v1/api-keys \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..." \ -H "Content-Type: application/json" \ -d '{ "name": "Production Backend", "permissions": ["users:read", "sessions:read", "authz:check"], "expires_at": "2025-12-31T23:59:59Z" }'

Request Body

{
  "name": "Production Backend",
  "permissions": ["users:read", "sessions:read", "authz:check"],
  "expires_at": "2025-12-31T23:59:59Z"
}

Security warning: The full API key is only returned once in this response. Store it in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.). If lost, revoke and create a new one.

Revoke API Key

Permanently revokes an API key. Any requests using this key will immediately receive 401. This action is irreversible.

DELETE/api/v1/api-keys/:id🔒 Auth

Revoke (delete) an API key.

curl -X DELETE https://id.vyntech.com.au/api/v1/api-keys/key_01H8ABCD1E3F5G7H \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

What's Next

Settings API →

Configure tenant settings, password policies, and session limits.

Public Endpoints →

Branding, password policy, OIDC discovery, and JWKS.

Authentication API →

Roles & Permissions API →

Manage roles and authorization checks.