API keys
Create an API key
To rotate a key: create the new one, deploy it, then revoke the old one.
POST
/v1/api-keysTL;DR
| Question | Answer |
|---|---|
| What does it do? | Create an API key. |
| What does it need? | An API key or an OAuth access token. |
| What does it take? | A JSON body with the fields below, and idempotency-key in a header. |
| What does it return? | Status 201 with a body of type CreatedApiKey. |
| In the SDK? | flung.apiKeys.create() |
| What can go wrong? | 401 Missing, unknown, revoked or expired API key; 403 This key cannot manage API keys; 422 The request failed validation; 429 Too many requests for this credential; wait for retry-after seconds. Every failure has the same error shape. |
What it does
To rotate a key: create the new one, deploy it, then revoke the old one. The new key has full access.
Example
bash
curl -X POST 'https://api.flung.dev/v1/api-keys' \ --header "Authorization: Bearer $FLUNG_API_KEY" \ --header 'Content-Type: application/json' \ --header "Idempotency-Key: $(uuidgen)" \ --data '{ "name": "Production server"}'ts
import { Flung } from '@flung.dev/sdk'
const flung = new Flung({ apiKey: process.env.FLUNG_API_KEY! })const result = await flung.apiKeys.create({ name: 'Production server',})js
const response = await fetch('https://api.flung.dev/v1/api-keys', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.FLUNG_API_KEY}`, 'Content-Type': 'application/json', 'Idempotency-Key': crypto.randomUUID(), }, body: JSON.stringify({ name: 'Production server', }),})if (!response.ok) throw new Error((await response.json()).error.message)const result = await response.json()A successful answer looks like this:
json
{ "id": "key_aaaaaaaaaaaaaaaaaaaaaaaa", "name": "string", "prefix": "flung_sk_live_abcd", "scopes": [ "string" ], "lastUsedAt": "2026-11-01T09:00:00.000Z", "expiresAt": "2026-11-01T09:00:00.000Z", "revokedAt": "2026-11-01T09:00:00.000Z", "createdAt": "2026-11-01T09:00:00.000Z", "key": "string"}Header parameters
| Field | Type | Required | Description |
|---|---|---|---|
idempotency-key | string | no | Any unique string, such as a UUID. A retry with the same key and body within 24 hours gets the first answer instead of running again. |
Request body
The body has the type an object, with the fields below.
| Field | Type | Required | Description |
|---|---|---|---|
name | string | yes | at least 1 character; at most 100 characters. |
expiresAt | string | no | When the key stops working. Omit for a key that does not expire. |
Responses
| Status | Meaning | Body |
|---|---|---|
| 201 | The key, shown once. | CreatedApiKey |
| 401 | Missing, unknown, revoked or expired API key. | Error |
| 403 | This key cannot manage API keys. | Error |
| 422 | The request failed validation. | Error |
| 429 | Too many requests for this credential; wait for retry-after seconds. | Error |
Response body
A 201 answer has the type CreatedApiKey.
| Field | Type | Required | Description |
|---|---|---|---|
id | string | yes | |
name | string | yes | |
prefix | string | yes | The start of the key, to tell keys apart. |
scopes | string[] | yes | |
lastUsedAt | string | null | yes | |
expiresAt | string | null | yes | |
revokedAt | string | null | yes | |
createdAt | string | yes | |
key | string | yes | The secret key. Shown only in this response; store it now. |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint |
| Schemas | Every request and response type |
| Errors | Every error code and what to do about it |