API Keys
Create, list, and revoke API keys for programmatic access.
API keys allow your applications to push jobs without managing JWTs. Each key is scoped to a single organization and prefixed with sc_.
The raw key value is returned once at creation time. Store it securely — it cannot be retrieved again.
List API Keys
GET /api-keys
Authorization: Bearer <token>Response 200
[
{
"id": "key_abc123",
"name": "CI pipeline",
"created_at": "2026-05-01T09:00:00Z",
"last_used_at": "2026-05-24T10:00:00Z"
}
]The raw key value is never returned in list responses.
Create an API Key
POST /api-keys
Authorization: Bearer <token>
Content-Type: application/jsonRequest body
{
"name": "CI pipeline"
}Response 201
{
"key": {
"id": "key_abc123",
"name": "CI pipeline",
"created_at": "2026-05-24T10:00:00Z"
},
"raw_key": "sc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}Copy raw_key immediately — it will not be shown again.
Delete / Revoke an API Key
DELETE /api-keys/{id}
Authorization: Bearer <token>Response 204 No Content
The key is invalidated immediately. Any in-flight requests using it will receive 401.
Using an API Key
Pass the raw key in one of two ways:
X-API-Key: sc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxor
Authorization: Bearer sc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxBoth are equivalent. The X-API-Key header is preferred for job ingestion from backend services.
Quick Reference
# List keys
curl http://localhost:8080/api-keys \
-H "Authorization: Bearer YOUR_JWT"
# Create a key
curl -X POST http://localhost:8080/api-keys \
-H "Authorization: Bearer YOUR_JWT" \
-H "Content-Type: application/json" \
-d '{"name":"production"}'
# Delete a key
curl -X DELETE http://localhost:8080/api-keys/key_abc123 \
-H "Authorization: Bearer YOUR_JWT"