API keys

API keys are the credential for programmatic access. They authenticate every protected endpoint except the deliberately session-only ones.

curl -s "$BASE/wallets" -H "Authorization: Bearer aro_sk_…"

Properties


Format	`aro_sk_` prefix + 256 bits of entropy
Shown	Exactly once, in the `POST /keys` response (`plaintext`)
Stored	SHA-256 hash only; the platform cannot recover a lost key
Displayed later	Prefix + metadata (`keyPrefix`, `lastUsedAt`, `expiresAt`, …)
Limit	10 active keys per account
Expiry	Always: 90 days by default, 1–365 days with `expiresInDays`
Management	Session-only: keys are created and revoked from a browser session, never with another key. Creating one also needs your password (and a 2FA code when 2FA is on): step-up
Survives	Nothing that resets the account: a password change, an admin password or 2FA reset, and a deactivation all revoke every key, for good (details)

Create a key

In the dashboard: Settings → API keys → Create key, then confirm with your password (and a code from your authenticator app when 2FA is on). Or from a session-authenticated request:

curl -s "$BASE/keys" -b cookies.txt \
  -H "content-type: application/json" \
  -d '{"name":"CI integration","expiresInDays":90,"password":"…","code":"123456"}'

Leave code out when 2FA is off; it is required when 2FA is on. A wrong password or code is 401 invalid_credentials / invalid_totp_code. Wrong passwords count toward the step-up password lock (separate from sign-in’s), and every code tried counts toward the 2FA code cap shared with sign-in; either lock answers 423 account_locked (lockout behavior). A code works once.

{
  "ok": true,
  "data": {
    "key": {
      "id": "ckkey0001…",
      "name": "CI integration",
      "keyPrefix": "aro_sk_3f9",
      "lastUsedAt": null,
      "expiresAt": "2026-11-11T09:00:00.000Z",
      "revokedAt": null,
      "revokedReason": null,
      "createdAt": "2026-08-13T09:00:00.000Z"
    },
    "plaintext": "aro_sk_…full key, shown only now…"
  }
}

Copy plaintext into your secret manager immediately; it is never shown again. If it’s lost, revoke the key and create a new one.

Hitting the cap returns 400 key_limit_reached; revoke unused keys first.

List and audit

GET /keys (works with either credential) returns metadata only. lastUsedAt tells you whether a key is actually in use, useful before revoking during rotation.

Revoke

curl -s -X DELETE "$BASE/keys/$KEY_ID" -b cookies.txt

Revocation is immediate and idempotent; repeat calls return the same success. Expired keys stop authenticating the moment expiresAt passes. revokedReason says who revoked a key: user (you), or the recovery action that did (password_changed, admin_password_reset, admin_2fa_reset, account_deactivated).

Rotation playbook

Create the replacement key

Give it a name that identifies the consumer (payments-service-2026Q3).

Deploy the new key

Update the secret in your deployment; confirm traffic via lastUsedAt.

Revoke the old key

DELETE /keys/{id} takes effect instantly. Anything still using it starts receiving 401 invalid_api_key, which is how you find stragglers.

If a key leaks

Revoke it from the dashboard immediately. Scope damage is bounded by design: a key can move sandbox funds, but it cannot create keys, change the password, manage 2FA or passkeys, or export wallet keys; those are session-only. Changing your password revokes every key at once, and account deactivation (an admin action) revokes all keys and kills all sessions; reactivation does not bring the keys back.

Get started

Core concepts

Guides

Security & access

Support

Properties

Create a key

List and audit

Revoke

Rotation playbook

If a key leaks

​Properties

​Create a key

​List and audit

​Revoke

​Rotation playbook

​If a key leaks

Properties

Create a key

List and audit

Revoke

Rotation playbook

If a key leaks