> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revalonlabs.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys Console Endpoints — Create and Revoke

> Create, list, and revoke API keys for programmatic access to the Predexy external API. Keys are shown only once at creation — store them securely.

API keys give automated clients — trading bots, data pipelines, and server-side integrations — access to Predexy's external endpoints without a browser session. Each key is prefixed with `pdx_` and shown **once** at creation; the full value is hashed on the server immediately and cannot be retrieved again. These endpoints require a console session JWT.

## Authentication

All key management endpoints require a session JWT from the Developer Console auth flow:

```
Authorization: Bearer <your_jwt>
```

## Endpoints

| Method   | Path                        | Description              |
| -------- | --------------------------- | ------------------------ |
| `POST`   | `/api/v1/console/keys`      | Create a new API key     |
| `GET`    | `/api/v1/console/keys`      | List your API keys       |
| `DELETE` | `/api/v1/console/keys/{id}` | Revoke a key permanently |

***

## Create an API key

```
POST https://api.predexy.com/api/v1/console/keys
```

Generates a new API key for your account. The response includes the full raw key — copy it now because it will not be shown again.

### Request body

<ParamField body="name" type="string" required>
  Human-readable label for the key, e.g. `"Production Trading Bot"`. 1–100 characters.
</ParamField>

<ParamField body="permissions" type="string" default="[&#x22;read:arbitrage&#x22;,&#x22;read:markets&#x22;,&#x22;read:questions&#x22;]">
  JSON-encoded array of permission strings. Default grants read access to arbitrage, markets, and questions.
</ParamField>

<ParamField body="rate_limit" type="number" default="60">
  Custom rate limit in requests per minute. Range 1–10,000. Defaults to 60.
</ParamField>

### Example request

```bash cURL theme={null}
curl -X POST https://api.predexy.com/api/v1/console/keys \
  -H "Authorization: Bearer <your_jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Trading Bot",
    "permissions": "[\"read:arbitrage\",\"read:markets\"]",
    "rate_limit": 600
  }'
```

### CreateAPIKeyResponse fields

<ResponseField name="data.id" type="string" required>
  API key UUID. Use this to revoke the key later.
</ResponseField>

<ResponseField name="data.name" type="string" required>
  The label you assigned.
</ResponseField>

<ResponseField name="data.key" type="string" required>
  The full API key, prefixed with `pdx_`. **This is the only time the full key is returned.** Store it in a secrets manager immediately.
</ResponseField>

<ResponseField name="data.key_prefix" type="string" required>
  First 12 characters of the key, used for identification in future list responses, e.g. `pdx_a1b2c3d4`.
</ResponseField>

<ResponseField name="data.permissions" type="string" required>
  JSON-encoded permissions array as stored.
</ResponseField>

<ResponseField name="data.rate_limit" type="number" required>
  Rate limit in requests per minute.
</ResponseField>

<ResponseField name="message" type="string" required>
  Warning message confirming the key will not be shown again.
</ResponseField>

### Sample response

```json theme={null}
{
  "data": {
    "id": "9b1f7e2a-3c4d-5e6f-7a8b-9c0d1e2f3a4b",
    "name": "Production Trading Bot",
    "key": "pdx_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "key_prefix": "pdx_a1b2c3d4",
    "permissions": "[\"read:arbitrage\",\"read:markets\"]",
    "rate_limit": 600
  },
  "message": "Save this API key — it will not be shown again."
}
```

<Warning>
  Copy the `key` field from the response immediately. The server stores only a hash of the key — there is no way to recover or display the full value after this response is received. If you lose the key, revoke it and create a new one.
</Warning>

***

## List API keys

```
GET https://api.predexy.com/api/v1/console/keys
```

Returns all API keys for your account. Only the key prefix is shown — the full key is never returned after creation.

### Example request

```bash cURL theme={null}
curl https://api.predexy.com/api/v1/console/keys \
  -H "Authorization: Bearer <your_jwt>"
```

### APIKeyInfo fields

<ResponseField name="id" type="string" required>
  API key UUID.
</ResponseField>

<ResponseField name="name" type="string" required>
  Human-readable label.
</ResponseField>

<ResponseField name="key_prefix" type="string" required>
  First 12 characters for identification, e.g. `pdx_a1b2c3d4`.
</ResponseField>

<ResponseField name="permissions" type="string" required>
  JSON-encoded permission array.
</ResponseField>

<ResponseField name="rate_limit" type="number" required>
  Rate limit in requests per minute.
</ResponseField>

<ResponseField name="is_active" type="boolean" required>
  `false` if the key has been revoked.
</ResponseField>

<ResponseField name="last_used_at" type="string">
  ISO 8601 timestamp of the most recent successful request. `null` if the key has never been used.
</ResponseField>

<ResponseField name="created_at" type="string" required>
  ISO 8601 timestamp when the key was created.
</ResponseField>

### Sample response

```json theme={null}
{
  "data": [
    {
      "id": "9b1f7e2a-3c4d-5e6f-7a8b-9c0d1e2f3a4b",
      "name": "Production Trading Bot",
      "key_prefix": "pdx_a1b2c3d4",
      "permissions": "[\"read:arbitrage\",\"read:markets\"]",
      "rate_limit": 600,
      "is_active": true,
      "last_used_at": "2026-04-25T14:55:30Z",
      "created_at": "2026-04-01T09:00:00Z"
    }
  ],
  "meta": { "count": 1 }
}
```

***

## Revoke an API key

```
DELETE https://api.predexy.com/api/v1/console/keys/{id}
```

Deactivates the key immediately. Any in-flight request using the revoked key will receive `401 INVALID_API_KEY`. Revocation is permanent — the key cannot be reactivated.

### Path parameters

<ParamField path="id" type="string" required>
  UUID of the API key to revoke.
</ParamField>

### Example request

```bash cURL theme={null}
curl -X DELETE https://api.predexy.com/api/v1/console/keys/9b1f7e2a-3c4d-5e6f-7a8b-9c0d1e2f3a4b \
  -H "Authorization: Bearer <your_jwt>"
```

### Sample response

```json theme={null}
{
  "data": {
    "id": "9b1f7e2a-3c4d-5e6f-7a8b-9c0d1e2f3a4b",
    "status": "revoked"
  }
}
```