Skip to main content
API keys authenticate every data-plane call. Manage them from the dashboard, or with these endpoints. Keys belong to your organization and carry its plan and limits.

​
List keys

Only key_prefix is returned. The full secret is shown once, at creation. status is active or expired; revoked keys are not listed. expires_at is null for a key that never expires.

​
Create a key

raw_key appears in this response only. The secret is stored encrypted and Anona cannot show it again. A lost key must be revoked and replaced.

​
Revoke a key

Returns 204 No Content. Revocation is immediate and permanent.
To rotate a key: create the new one, cut traffic over, then revoke the old one. Plan and limits come from the organization, so a rotated key keeps exactly the same access.

​
Expiry

A key created with expires_in_days stops working on its own. Until then nothing changes. Expiry is a deadline, not a reduced level of access.
  • Omitting expires_in_days means the key never expires, which is how every key behaved before this option existed. Existing keys are unaffected.
  • An expired key is rejected with 401 and the error code key_expired, distinct from invalid_api_key. Branch on the code: key_expired means rotate, invalid_api_key means the key was never valid.
  • Expiry cannot be extended. There is no endpoint to push the date back. Create a replacement key and cut traffic over, as with rotation.
  • Anona emails the key’s owner about a week before the date, so the deadline does not arrive unannounced.
Use a short expiry for anything handed to a third party, a CI job, or a demo. A leaked key with a deadline stops being a liability on a date you chose in advance.

​
Next steps

Authentication

How keys are sent, and how to handle them safely.

Usage

Credits and rate limits for the calling key.