API keys

Bearer credentials for the REST API. See Authentication for how they're used and how to keep them safe.

GET/keys/

Returns array<ApiKey> — prefix and last-used only, never the secret.

POST/keys/create

Body { name: string }.

Returns an ApiKey plus key: string — the full secret, shown this one time only.

curl https://sauti-pbx.services.co.ke/api/keys/create \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "name": "production server" }'

// → 201 Created — the full "key" is shown this one time only
{ "uuid": "...", "prefix": "sk_live_ab", "key": "sk_live_abcd..." }

const res = await fetch('https://sauti-pbx.services.co.ke/api/keys/create', {
  method: 'POST',
  headers: { 'Authorization': 'Bearer sk_live_...', 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'production server' }),
});
const { key } = await res.json();
// store `key` now — it will not be shown again

import requests

res = requests.post(
    'https://sauti-pbx.services.co.ke/api/keys/create',
    headers={'Authorization': 'Bearer sk_live_...'},
    json={'name': 'production server'},
)
key = res.json()['key']
# store `key` now — it will not be shown again

POST/keys/revoke

Body { uuid: string }. Returns { message: string }.

The ApiKey object

Field	Type	Description
uuid	string	Stable identifier (use with revoke).
name	string	Your label.
prefix	string	First chars of the key, to tell keys apart.
is_active	boolean	Whether the key still works.
last_used_at / created_at	string, nullable	ISO-8601 timestamps.