User API keys
End users can create personal API keys with the prefix uak_. Use these keys in your own application APIs.
User API keys cannot call CMS content routes as Bearer tokens.
Create a key
[POST] /auth/api-keys
Requires the user access token.
Body
| Name | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Key label |
scopes | array | No | Optional scopes for your app |
expires_at | string | No | Optional expiry timestamp |
Response
The response includes plain_text_key once. Store it immediately. You cannot read the full key again later.
List keys
[GET] /auth/api-keys
Requires the user access token. Returns key metadata without the secret value.
Revoke a key
[POST] /auth/api-keys/{keyId}/revoke
Requires the user access token.
Introspect a key
Your server can validate a uak_… key with a project Sanctum token that has the introspect ability.
[POST] /auth/api-keys/introspect
Headers
| Name | Required | Description |
|---|---|---|
project-id | Yes | Project UUID |
Authorization | Yes | Bearer PROJECT_SANCTUM_TOKEN with introspect |
Body
{
"api_key": "uak_..."
}Response shape
{
"active": true,
"project_uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"user_uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"scopes": [],
"expires_at": null,
"key_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"key_prefix": "uak_abcd"
}Dashboard
Admins can review end-user keys under Project settings → Authentication → API keys.
Next
- API Access — create a project token with
introspect - API reference