> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memory.anonalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, list, and revoke API keys programmatically.

API keys authenticate every data-plane call. Manage them from the dashboard, or with
these endpoints. A key is minted by a member and carries the organization's plan and
limits.

> [!NOTE]
>
> These management endpoints are part of the control plane: they authenticate with a
> **dashboard session**, not an API key. Calling them with `Bearer anona_live_...`
> returns `401 session_required`. Creating and revoking keys additionally requires the
> owner, admin, or developer role.

| Method and path | What it does |
| - | - |
| `GET /v1/api-keys` | Lists the calling member's keys, with prefixes only. |
| `POST /v1/api-keys` | Creates a key and returns the secret once. |
| `DELETE /v1/api-keys/{id}` | Revokes a key immediately. |

These are ordinary HTTPS calls in any language; the memory SDKs deliberately do not wrap
them, because they authenticate with a session rather than the API key those clients
hold. `$SESSION` below is the session token the dashboard sign-in returns.

## List keys

```http theme={null}
GET /v1/api-keys
```

```bash cURL theme={null}
curl https://api.anonalabs.com/v1/api-keys \
  -H "Authorization: Bearer $SESSION"
```

```python Python theme={null}
import httpx

keys = httpx.get(
    "https://api.anonalabs.com/v1/api-keys",
    headers={"Authorization": f"Bearer {SESSION}"},
).json()
```

```typescript TypeScript theme={null}
const res = await fetch("https://api.anonalabs.com/v1/api-keys", {
  headers: { Authorization: `Bearer ${SESSION}` },
});
const keys = await res.json();
```

```json theme={null}
[
  {
    "id": "key_...",
    "name": "prod-bot",
    "key_prefix": "anona_live_3",
    "env": "live",
    "created_at": "...",
    "last_used_at": "...",
    "expires_at": null,
    "status": "active"
  }
]
```

Returns the keys the calling member created. Only `key_prefix` — the first few
characters of the secret — is returned; the full secret is shown once, at creation.

`status` is `active` or `expired`; revoked keys are not listed. `expires_at` is
`null` for a key that never expires.

## Create a key

```http theme={null}
POST /v1/api-keys

{ "name": "prod-bot", "env": "live", "expires_in_days": 90 }
```

| Field | Type | Required | Description |
| - | - | - | - |
| `name` | string | Yes | A label to identify the key later. |
| `env` | string | No | `"live"` (default) or `"test"`. |
| `expires_in_days` | integer | No | Days until the key stops working, 1-3650. Omit for a key that never expires. |

```bash cURL theme={null}
curl -X POST https://api.anonalabs.com/v1/api-keys \
  -H "Authorization: Bearer $SESSION" \
  -H "Content-Type: application/json" \
  -d '{ "name": "prod-bot", "env": "live", "expires_in_days": 90 }'
```

```python Python theme={null}
created = httpx.post(
    "https://api.anonalabs.com/v1/api-keys",
    headers={"Authorization": f"Bearer {SESSION}"},
    json={"name": "prod-bot", "env": "live", "expires_in_days": 90},
).json()
secret = created["api_key"]  # returned once
```

```typescript TypeScript theme={null}
const res = await fetch("https://api.anonalabs.com/v1/api-keys", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${SESSION}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "prod-bot", env: "live", expires_in_days: 90 }),
});
const created = await res.json();
const secret = created.api_key; // returned once
```

```json theme={null}
{
  "id": "key_...",
  "name": "prod-bot",
  "key_prefix": "anona_live_3",
  "env": "live",
  "created_at": "2026-08-15T09:00:00Z",
  "last_used_at": null,
  "expires_at": "2026-11-13T09:00:00Z",
  "status": "active",
  "api_key": "anona_live_XXXXXXXXXXXXXXXXXXXX"
}
```

> [!WARNING]
>
> `api_key` — the full secret — appears in this response only. It is stored encrypted and
> Anona cannot show it again. A lost key must be revoked and replaced.

## Revoke a key

```http theme={null}
DELETE /v1/api-keys/{id}
```

```bash cURL theme={null}
curl -X DELETE https://api.anonalabs.com/v1/api-keys/key_123 \
  -H "Authorization: Bearer $SESSION"
```

```python Python theme={null}
httpx.delete(
    "https://api.anonalabs.com/v1/api-keys/key_123",
    headers={"Authorization": f"Bearer {SESSION}"},
)
```

```typescript TypeScript theme={null}
await fetch("https://api.anonalabs.com/v1/api-keys/key_123", {
  method: "DELETE",
  headers: { Authorization: `Bearer ${SESSION}` },
});
```

Returns `204 No Content`. Revocation is immediate and permanent.

> [!NOTE]
>
> To rotate a key: create the new one, cut traffic over, then revoke the old one. Plan and
> limits come from the organization, so a rotated key keeps exactly the same access.

## Expiry

A key created with `expires_in_days` stops working on its own. Until then nothing
changes. Expiry is a deadline, not a reduced level of access.

* **Omitting `expires_in_days` means the key never expires**, which is how every key
  behaved before this option existed. Existing keys are unaffected.
* An expired key is rejected with `401` and the error code **`key_expired`**, distinct
  from `invalid_api_key`. Branch on the code: `key_expired` means rotate,
  `invalid_api_key` means the key was never valid.
* **Expiry cannot be extended.** There is no endpoint to push the date back. Create a
  replacement key and cut traffic over, as with rotation.
* Anona emails the key's owner about a week before the date, so the deadline does not
  arrive unannounced.

> [!TIP]
>
> Use a short expiry for anything handed to a third party, a CI job, or a demo. A leaked
> key with a deadline stops being a liability on a date you chose in advance.

## Next steps

> **[Authentication](https://docs.memory.anonalabs.com/api-reference/authentication.md)**
>
> How keys are sent, and how to handle them safely.

> **[Usage](https://docs.memory.anonalabs.com/api-reference/usage.md)**
>
> Credits and rate limits for the calling key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.