Docs
API keys

Rename or re-scope a key

PATCH
/v1/api-keys/{id}

Needs an admin key (fx_admin_…), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with ADMIN_KEY_REQUIRED.

New scopes replace the old ones and apply from the key's next request. The key itself does not change, so nothing using it needs redeploying. A revoked key cannot be changed.

A console session confirms it's you first only when the change widens the key to a scope that can move money or accounts (trading:execute, trading:reduce, accounts:write) it did not already hold, or changes the limits on a key that already has some. Narrowing scopes, renaming, or adding limits to a key that had none, never asks.

Authorization

adminKey
AuthorizationBearer <token>

Authorization: Bearer fx_admin_<id>_<secret>.

An admin key manages this workspace's ordinary API keys (/v1/api-keys) and can do nothing else. Only the workspace owner makes one, in the console, optionally limited to IP addresses and given an expiry. Every request made with one is audited.

In: header

Path Parameters

id*string
Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Properties1 <= properties

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v1/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Content-Type: application/json" \  -d '{}'
{  "data": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "name": "string",    "publicId": "string",    "hint": "string",    "environment": "live",    "scopes": [      "string"    ],    "lastUsedAt": null,    "expiresAt": null,    "revokedAt": null,    "createdAt": "2019-08-24T14:15:22Z",    "limits": null,    "createdBy": null,    "createdByAdminKey": null  }}

Read one key GET

**Needs an admin key** (`fx_admin_…`), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with `ADMIN_KEY_REQUIRED`. A key's name, scopes, environment label, hint and when it was last used — never the key itself, which is shown only once, when it is created.

Revoke a key POST

**Needs an admin key** (`fx_admin_…`), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with `ADMIN_KEY_REQUIRED`. Refused from its very next request — there is no cache to wait for. Revoking an already-revoked key succeeds and changes nothing, so a retried revoke is safe.