Create API key

Session-only. Create a key. The response’s plaintext (the full aro_sk_… secret) is shown exactly once; only its SHA-256 hash is stored. Accounts can hold at most 10 active keys.

POST /keys

Create API key

cURL

curl --request POST \
  --url https://aropay.aro.media/api/v1/keys \
  --header 'Content-Type: application/json' \
  --cookie aropay_session= \
  --data '
{
  "name": "CI integration"
}
'

201

{
  "ok": true,
  "data": {
    "key": {
      "id": "ckkey0001abcd",
      "name": "CI integration",
      "keyPrefix": "aro_sk_3f9",
      "lastUsedAt": null,
      "expiresAt": "2026-11-11T09:00:00.000Z",
      "revokedAt": null,
      "createdAt": "2026-08-13T09:00:00.000Z"
    },
    "plaintext": "aro_sk_3f9d…"
  }
}

Authorizations

aropay_session · string · cookie · required

Browser session cookie minted by POST /auth/login (or passkey login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked Session-only accept only this credential and return 403 session_required for API keys.

Body

application/json

name · string · required

Label identifying the consumer, e.g. "CI integration".

expiresInDays · integer

Optional expiry. Omit for a non-expiring key.

Required range: 1 <= x <= 365

Response

201

application/json

Key created. Store plaintext now; it is never shown again.

ok · any · required

data · object · required

Show child attributes