Skip to main content
A personal API key (byk_-prefixed) is the user-principal credential most CLI, SDK, and direct API calls authenticate with — see Authentication for how it’s used on requests. This page covers managing the keys themselves.
Key management is JWT-only — keys can never manage keys. Every operation below requires a supabaseJwt and rejects a byk_ key, even one belonging to the same user.

​
Listing keys

Returns APIKeyListResponse: { "api_keys": [ ...APIKey ] }. Each entry exposes only a masked view of the key:
​
string
required
Identifier for the key, used to revoke it.
​
string
Optional display label, up to 128 characters.
​
string
required
The key’s prefix, for identifying it without exposing the secret.
​
string
required
The last 4 characters of the secret.
​
string
required
Creation timestamp.
​
string
Revocation timestamp, if revoked.

​
Creating a key

Request body (APIKeyCreateRequest, optional):
​
string
Display label, up to 128 characters.
Returns 201 with APIKeyCreateResponse:
​
object
required
The new key’s APIKey metadata (masked, as in list).
​
string
required
The full secret value. Store it as a user-principal API key.
secret is shown exactly once, in the create response. There is no way to retrieve it again afterward — list only ever returns display_prefix/display_last4. If it’s lost, revoke the key and create a new one.

​
Revoking a key

Returns 204 on success.

Authentication

Organizations