curl --request POST \
--url https://aropay.aro.media/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"name": "CI integration",
"password": "…"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'CI integration', password: '…'})
};
fetch('https://aropay.aro.media/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/keys"
payload = {
"name": "CI integration",
"password": "…"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"key": {
"id": "ckkey0001abcd",
"name": "CI integration",
"keyPrefix": "aro_sk_3f9",
"lastUsedAt": null,
"expiresAt": "2026-11-11T09:00:00.000Z",
"revokedAt": null,
"revokedReason": null,
"createdAt": "2026-08-13T09:00:00.000Z"
},
"plaintext": "aro_sk_3f9d…"
}
}Create API key
Session-only, with step-up. Create a key after re-checking the
password (and a 2FA code when enabled). The response’s plaintext
(the full aro_sk_… secret) is shown exactly once; only its SHA-256
hash is stored. Every key expires (90 days unless expiresInDays
says otherwise) and is revoked by the next password change, admin
password or 2FA reset, or deactivation. Accounts can hold at most 10
active keys.
curl --request POST \
--url https://aropay.aro.media/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"name": "CI integration",
"password": "…"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'CI integration', password: '…'})
};
fetch('https://aropay.aro.media/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/keys"
payload = {
"name": "CI integration",
"password": "…"
}
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"key": {
"id": "ckkey0001abcd",
"name": "CI integration",
"keyPrefix": "aro_sk_3f9",
"lastUsedAt": null,
"expiresAt": "2026-11-11T09:00:00.000Z",
"revokedAt": null,
"revokedReason": null,
"createdAt": "2026-08-13T09:00:00.000Z"
},
"plaintext": "aro_sk_3f9d…"
}
}Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.
Body
Label identifying the consumer, e.g. "CI integration".
Step-up. The account password, re-entered.
Days until the key expires.
1 <= x <= 365Step-up. A fresh authenticator code; required when 2FA is enabled, ignored otherwise. Single-use.
^[0-9]{6}$