API keys docs

Send the raw key in the X-Contently-Key header instead of Authorization/X-Tenant-Id. When this header is present it is used exclusively — any Authorization header on the same request is ignored, and an invalid or revoked key returns 401 rather than falling back to a Bearer token.

Results are scoped to the key's own space: reads also include tenant-wide and global models; writes are restricted to rows that exactly belong to the key's space (a write key cannot edit a tenant-wide model, and a mismatched spaceId in a create request body is rejected with 400). A model/content item belonging to a different space returns 404, the same as a genuinely missing item.

All key management routes require the caller to have the admin role in the space.

Creates a new key for the space. The raw key is returned once in the response and is never retrievable again — store it securely.

{
  "id": 1,
  "name": "Frontend read key",
  "keyType": "read",
  "keyPrefix": "a3f9c1d2",
  "status": "active",
  "createdAt": "2026-08-15T00:00:00.000Z",
  "key": "raw-key-shown-once"
}

Returns all keys for the space, ordered by creation date. Never includes the raw key or its hash — only keyPrefix for identification.

{
  "keys": [
    {
      "id": 1,
      "name": "Frontend read key",
      "keyPrefix": "a3f9c1d2",
      "keyType": "read",
      "status": "active",
      "lastUsedAt": null,
      "createdByUserId": "user-uuid",
      "createdAt": "2026-08-15T00:00:00.000Z"
    }
  ]
}

Permanently revokes the key and cannot be reactivated. Takes effect immediately on the server instance handling this request; if the API runs as more than one instance, other instances stop accepting the key once their local cache entry expires (up to API_KEY_CACHE_TTL_MS, default 5 minutes). Returns 404 if the key doesn't exist or is already revoked.

{
  "success": true
}