Create API key
curl --request POST \
--url https://aropay.aro.media/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"name": "CI integration"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'CI integration'})
};
fetch('https://aropay.aro.media/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/keys"
payload = { "name": "CI integration" }
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"key": {
"id": "ckkey0001abcd",
"name": "CI integration",
"keyPrefix": "aro_sk_3f9",
"lastUsedAt": null,
"expiresAt": "2026-11-11T09:00:00.000Z",
"revokedAt": null,
"createdAt": "2026-08-13T09:00:00.000Z"
},
"plaintext": "aro_sk_3f9d…"
}
}{
"ok": false,
"error": {
"code": "key_limit_reached",
"message": "You already have 10 active API keys."
}
}{
"ok": false,
"error": {
"code": "invalid_api_key",
"message": "Invalid API key."
}
}{
"ok": false,
"error": {
"code": "session_required",
"message": "This action requires a browser session."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}API keys
Create API key
Session-only. Create a key. The response’s plaintext (the full
aro_sk_… secret) is shown exactly once; only its SHA-256 hash is
stored. Accounts can hold at most 10 active keys.
POST
/
keys
Create API key
curl --request POST \
--url https://aropay.aro.media/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"name": "CI integration"
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'CI integration'})
};
fetch('https://aropay.aro.media/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/keys"
payload = { "name": "CI integration" }
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"key": {
"id": "ckkey0001abcd",
"name": "CI integration",
"keyPrefix": "aro_sk_3f9",
"lastUsedAt": null,
"expiresAt": "2026-11-11T09:00:00.000Z",
"revokedAt": null,
"createdAt": "2026-08-13T09:00:00.000Z"
},
"plaintext": "aro_sk_3f9d…"
}
}{
"ok": false,
"error": {
"code": "key_limit_reached",
"message": "You already have 10 active API keys."
}
}{
"ok": false,
"error": {
"code": "invalid_api_key",
"message": "Invalid API key."
}
}{
"ok": false,
"error": {
"code": "session_required",
"message": "This action requires a browser session."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.
Body
application/json