API Key Management - RepoCloud Documentation

Overview

API keys are managed through the /api/v1/keys endpoints. Unlike the instance endpoints, key management uses session authentication (your browser login) rather than Bearer token authentication. This means these endpoints are primarily used by the dashboard UI. For most users, the API / MCP tab in the dashboard is the simplest way to manage keys.

Key management endpoints require an active browser session (cookie-based auth) and a CSRF token. They cannot be called with a Bearer API key.

List Keys

Retrieve all API keys for your account.

GET /api/v1/keys

Example Request

curl https://repocloud.io/api/v1/keys \
  -H "Cookie: session=your_session_cookie"

Response (200 OK)

[
  {
    "id": 1,
    "name": "Default",
    "key_prefix": "rcmcp_a1b2c3",
    "is_active": true,
    "created_at": "2026-07-15T10:00:00",
    "last_used_at": "2026-07-20T14:30:00"
  },
  {
    "id": 2,
    "name": "CI Pipeline",
    "key_prefix": "rcmcp_d4e5f6",
    "is_active": true,
    "created_at": "2026-07-18T09:00:00",
    "last_used_at": null
  }
]

The full key is never returned by the list endpoint. Only the key_prefix (first 12 characters) is shown for identification.

Create a Key

Generate a new API key.

POST /api/v1/keys

Prerequisites

You must have deposited $1 or more to create API keys. If you have not deposited, the endpoint returns HTTP 402.

Request Headers

Header	Required	Description
`X-CSRFToken`	Yes	CSRF token from your session
`Cookie`	Yes	Your session cookie

Request Body

Field	Type	Required	Description
`name`	string	No	A label for the key (max 100 characters, defaults to “Default”)

Example Request

curl -X POST https://repocloud.io/api/v1/keys \
  -H "Content-Type: application/json" \
  -H "X-CSRFToken: your_csrf_token" \
  -H "Cookie: session=your_session_cookie" \
  -d '{"name": "Production Deploy"}'

Response (201 Created)

{
  "id": 3,
  "name": "Production Deploy",
  "key_prefix": "rcmcp_g7h8i9",
  "full_key": "rcmcp_g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2",
  "created_at": "2026-07-25T12:00:00"
}

The full_key is only returned in this response. Copy and store it securely. It cannot be retrieved again — you will only see the key_prefix in future requests.

Error Responses

Status	Error	Cause
402	`Deposit required`	You must deposit $1 or more at /billing before creating keys
403	`CSRF validation failed`	Missing or invalid `X-CSRFToken` header

Revoke a Key

Permanently deactivate an API key. Revoked keys cannot be used for API requests.

DELETE /api/v1/keys/{key_id}

Path Parameters

Parameter	Type	Description
`key_id`	integer	The key ID to revoke

Request Headers

Header	Required	Description
`X-CSRFToken`	Yes	CSRF token from your session
`Cookie`	Yes	Your session cookie

Example Request

curl -X DELETE https://repocloud.io/api/v1/keys/2 \
  -H "X-CSRFToken: your_csrf_token" \
  -H "Cookie: session=your_session_cookie"

Response (200 OK)

{
  "ok": true,
  "id": 2
}

Error Responses

Status	Error	Cause
403	`CSRF validation failed`	Missing or invalid `X-CSRFToken` header
404	`Key not found`	Key does not exist or belongs to another user

Revocation is immediate. Any in-flight requests using the revoked key will fail with a 401 error.

​Overview

​List Keys

​Example Request

​Response (200 OK)

​Create a Key

​Prerequisites

​Request Headers

​Request Body

​Example Request

​Response (201 Created)

​Error Responses

​Revoke a Key

​Path Parameters

​Request Headers

​Example Request

​Response (200 OK)

​Error Responses

Overview

List Keys

Example Request

Response (200 OK)

Create a Key

Prerequisites

Request Headers

Request Body

Example Request

Response (201 Created)

Error Responses

Revoke a Key

Path Parameters

Request Headers

Example Request

Response (200 OK)

Error Responses