Delete an API key
The key stops working at once, also on workspace hosts (the routers drop it with the next route delta).
openapi/harthelm.yaml at v1.5.0__Host-harthelm_session<token>Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header
Harthelm-CSRF: 1 and a matching Origin.
apikey*stringAn API key's id.
uuidDeleted.
curl -X DELETE 'https://console.example.com/api/v1/me/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08'Create an API key
Mints `hart_<id>_<secret>` for the caller. The response carries the key in `token` once; only the SHA-256 of the secret is stored. Use it as `Authorization: Bearer …` or `Harthelm-Authorization: Bearer …` on the API and as `Harthelm-Authorization: Bearer …` on private dev hosts and restricted custom domains. Browser sessions only (403 with an API key), so a leaked key cannot mint a successor that outlives its deletion.
The caller's API keys
Personal API keys, newest first. Secrets are never returned; a key is shown once, when it is created or regenerated. A key acts with all of its user's permissions.