Appearance

Create and rotate API keys ​

Create a new API key, rename an existing one, revoke a compromised key, and delete keys you no longer need. API keys live at the account level — each one grants the role of whoever minted it.

Prerequisites: You must be an OWNER or ADMIN. Your email must be verified — unverified users get 403 even if they have the right role. There is no auto-created Default API key for new accounts; you must create your first key explicitly.

Create a key ​

In the console ​

  1. Go to API Keys in the platform sidebar (/platform/api-keys).
  2. Click Create API Key.
  3. Give it a descriptive name (ci-payments-deploy, local-mike, terraform-prod).
  4. Optionally set an expiration date.
  5. Click Create.
  6. Copy the secret immediately. It starts with sk_api_. The console displays it once — there's no way to retrieve it later.

Via the API ​

bash
curl -X POST https://app.smplkit.com/api/v1/api_keys \
  -H "Authorization: Bearer $SMPLKIT_API_KEY" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "api_key",
      "attributes": {
        "name": "ci-payments-deploy",
        "expires_at": "2027-01-01T00:00:00Z"
      }
    }
  }'

The response includes the secret in plain text in data.attributes.secret exactly once. Save it before you make any other request.

Rename a key ​

In the console ​

In the API Keys list, click the key, edit the name, save.

Via the API ​

bash
curl -X PUT https://app.smplkit.com/api/v1/api_keys/$KEY_ID \
  -H "Authorization: Bearer $SMPLKIT_API_KEY" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "api_key",
      "id": "'$KEY_ID'",
      "attributes": {"name": "ci-payments-deploy-v2"}
    }
  }'

Revoke or delete a key ​

Revoke and delete both stop a key from working. The difference is whether the row stays in your audit trail.

  • Revoke keeps the row and marks status REVOKED. The key stops authenticating; deployments using it begin failing. Use revoke when a key may have been exposed.
  • Delete soft-deletes the row, removing it from listings. Use delete for housekeeping (an old key you no longer need).

Revoke ​

bash
curl -X POST https://app.smplkit.com/api/v1/api_keys/$KEY_ID/actions/revoke \
  -H "Authorization: Bearer $SMPLKIT_API_KEY"

Delete ​

bash
curl -X DELETE https://app.smplkit.com/api/v1/api_keys/$KEY_ID \
  -H "Authorization: Bearer $SMPLKIT_API_KEY"

Returns 204.

Rotate a key without downtime ​

To replace a deployed key without authentication failures:

  1. Mint a new key with POST /api/v1/api_keys and copy its secret.
  2. Roll the new secret out to every place that uses the old one (CI, env vars, secret manager). Update one deployment, validate, then continue.
  3. Once nothing references the old key, revoke the old key with POST /api/v1/api_keys/{id}/actions/revoke.
  4. After confirming no fallout for a few days, delete the old key for cleanup.

This sequence avoids the moment-of-truth where revoking before rolling out a replacement breaks production.

Limits ​

  • 50 API keys per account. Includes both active and revoked. Soft-deleted keys do not count.

When you hit the cap, creating returns 409 Conflict.

Verify ​

After creating a key:

bash
# List keys (any role)
curl https://app.smplkit.com/api/v1/api_keys \
  -H "Authorization: Bearer $SMPLKIT_API_KEY"

# Try the new key
curl https://app.smplkit.com/api/v1/users/current \
  -H "Authorization: Bearer sk_api_<your_new_secret>"

A 200 response with the user's profile confirms the key works.

After revoking or deleting:

bash
curl https://app.smplkit.com/api/v1/users/current \
  -H "Authorization: Bearer sk_api_<revoked_secret>"

Returns 401 Unauthorized.