API keys

Set, change or remove the key's webhook

Points the runFinished webhook of every run this key starts at a public https URL, or clears it with null. The signing secret (webhook_secret, whsec_…) is returned once, when the key first gets a URL and again on rotate_secret: true; changing the URL keeps it. Only the key's creator may call this.

patch/o/{org}/api-keys/{key}

Request

  • Base URL: https://api.prix.dev
  • URL: https://api.prix.dev/o/{org}/api-keys/{key}
  • Auth: HTTP bearer

Request body

webhook_urlstring uri nullable
rotate_secretboolean

Response

The key; webhook_secret only when a secret was minted.

idstring required

key_…; use it in the key routes.

kind'key' | 'oauth'

key is minted here; oauth is an MCP client a person connected by signing in. An oauth grant reaches only the MCP server, cannot be rotated and has no webhook; its expires_at is when it ends unless the client refreshes it.

namestring required
prefixstring required

The secret's first characters, to tell keys apart.

scopesApiKeyScope[] required
max_concurrentinteger required
webhook_urlstring nullable required
expires_atstring date-time nullable required
last_used_atstring date-time nullable required
created_atstring date-time required
secretstring

The key's secret. Only in the create and rotate responses; never shown again.

webhook_secretstring

The webhook signing secret. Only in the update response that minted it.

Changes

No recorded changes to this operation across all 2 revisions of this API.