> ## Documentation Index
> Fetch the complete documentation index at: https://docs.repocloud.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Management

> Create, list, and revoke API keys for programmatic access

## Overview

API keys are managed through the `/api/v1/keys` endpoints. Unlike the instance endpoints, key management uses **session authentication** (your browser login) rather than Bearer token authentication. This means these endpoints are primarily used by the dashboard UI.

For most users, the [API / MCP tab](https://repocloud.io/mcp) in the dashboard is the simplest way to manage keys.

<Note>
  Key management endpoints require an active browser session (cookie-based auth) and a CSRF token. They cannot be called with a Bearer API key.
</Note>

***

## List Keys

Retrieve all API keys for your account.

```
GET /api/v1/keys
```

### Example Request

```bash theme={null}
curl https://repocloud.io/api/v1/keys \
  -H "Cookie: session=your_session_cookie"
```

### Response (200 OK)

```json theme={null}
[
  {
    "id": 1,
    "name": "Default",
    "key_prefix": "rcmcp_a1b2c3",
    "is_active": true,
    "created_at": "2026-07-15T10:00:00",
    "last_used_at": "2026-07-20T14:30:00"
  },
  {
    "id": 2,
    "name": "CI Pipeline",
    "key_prefix": "rcmcp_d4e5f6",
    "is_active": true,
    "created_at": "2026-07-18T09:00:00",
    "last_used_at": null
  }
]
```

<Note>
  The full key is never returned by the list endpoint. Only the `key_prefix` (first 12 characters) is shown for identification.
</Note>

***

## Create a Key

Generate a new API key.

```
POST /api/v1/keys
```

### Prerequisites

You must have deposited \$1 or more to create API keys. If you have not deposited, the endpoint returns HTTP 402.

### Request Headers

| Header        | Required | Description                  |
| ------------- | -------- | ---------------------------- |
| `X-CSRFToken` | Yes      | CSRF token from your session |
| `Cookie`      | Yes      | Your session cookie          |

### Request Body

| Field  | Type   | Required | Description                                                     |
| ------ | ------ | -------- | --------------------------------------------------------------- |
| `name` | string | No       | A label for the key (max 100 characters, defaults to "Default") |

### Example Request

```bash theme={null}
curl -X POST https://repocloud.io/api/v1/keys \
  -H "Content-Type: application/json" \
  -H "X-CSRFToken: your_csrf_token" \
  -H "Cookie: session=your_session_cookie" \
  -d '{"name": "Production Deploy"}'
```

### Response (201 Created)

```json theme={null}
{
  "id": 3,
  "name": "Production Deploy",
  "key_prefix": "rcmcp_g7h8i9",
  "full_key": "rcmcp_g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2",
  "created_at": "2026-07-25T12:00:00"
}
```

<Warning>
  The `full_key` is only returned in this response. Copy and store it securely. It cannot be retrieved again — you will only see the `key_prefix` in future requests.
</Warning>

### Error Responses

| Status | Error                    | Cause                                                                                         |
| ------ | ------------------------ | --------------------------------------------------------------------------------------------- |
| 402    | `Deposit required`       | You must deposit \$1 or more at [/billing](https://repocloud.io/billing) before creating keys |
| 403    | `CSRF validation failed` | Missing or invalid `X-CSRFToken` header                                                       |

***

## Revoke a Key

Permanently deactivate an API key. Revoked keys cannot be used for API requests.

```
DELETE /api/v1/keys/{key_id}
```

### Path Parameters

| Parameter | Type    | Description          |
| --------- | ------- | -------------------- |
| `key_id`  | integer | The key ID to revoke |

### Request Headers

| Header        | Required | Description                  |
| ------------- | -------- | ---------------------------- |
| `X-CSRFToken` | Yes      | CSRF token from your session |
| `Cookie`      | Yes      | Your session cookie          |

### Example Request

```bash theme={null}
curl -X DELETE https://repocloud.io/api/v1/keys/2 \
  -H "X-CSRFToken: your_csrf_token" \
  -H "Cookie: session=your_session_cookie"
```

### Response (200 OK)

```json theme={null}
{
  "ok": true,
  "id": 2
}
```

### Error Responses

| Status | Error                    | Cause                                         |
| ------ | ------------------------ | --------------------------------------------- |
| 403    | `CSRF validation failed` | Missing or invalid `X-CSRFToken` header       |
| 404    | `Key not found`          | Key does not exist or belongs to another user |

<Note>
  Revocation is immediate. Any in-flight requests using the revoked key will fail with a 401 error.
</Note>