API Keys

Base path: /v1/admin/api-keys — Session-only. You cannot mint new keys using an existing key.

Plaintext values are returned once on creation or rotation and are never re-retrievable — only the prefix and a keyed hash are persisted. When BIGRAG_MASTER_KEY is unset, older development keys may use the legacy SHA-256 hash format.

During master-key rotation, API-key lookup checks BIGRAG_MASTER_KEY plus BIGRAG_MASTER_KEY_PREVIOUS, so existing keys continue to authenticate while you rotate and rewrite stored hashes.

GET /v1/admin/api-keys — List keys

POST /v1/admin/api-keys — Create key

PATCH /v1/admin/api-keys/{key_id} — Update key

POST /v1/admin/api-keys/{key_id}/rotate — Rotate key

DELETE /v1/admin/api-keys/{key_id} — Delete key