viewer’s key reads but cannot write.
Every role may mint and revoke their own keys. Admins can see and revoke all keys in the organization.
Create a key
Mints a new API key. Copy thesecret field immediately — it is shown exactly once and cannot be retrieved again.
POST /api/keys
string
A label for this key, such as
"CI pipeline" or "LiveKit telemetry". Helps you identify it later in the key list.string
Scope the key to a specific project. Omit to create an organization-scoped key that can read and write across all projects. Pass a
prj_ identifier to restrict the key to one project area.201 Created with the new key object including the plaintext secret.
string
The key’s identifier. Use this to revoke the key later.
string
The full API key beginning with
egma_sk_. This is the only time this value is returned. Copy it now.string
The label you gave the key.
string
"organization" or "project", depending on whether project_id was provided.string | null
The project this key is scoped to, or
null for organization-scoped keys.string
The organization this key belongs to.
string
A non-secret hint showing the key’s prefix and last few characters — enough to identify which key is which without exposing the secret.
string
The user ID of whoever minted this key.
string
ISO 8601 timestamp of when the key was created.
string | null
ISO 8601 timestamp of the last request authenticated with this key.
null if the key has never been used.string | null
ISO 8601 timestamp of when the key was revoked.
null for active keys.Create an organization-scoped key
Create a project-scoped key
The
secret field is returned only once, at creation time. Egma stores only a hash. If you lose the secret, revoke the key and mint a new one.List keys
Returns all API keys you are allowed to see. Admins see every key in the organization. All other roles see only the keys they minted. Secrets are never included in list responses.GET /api/keys
array
Array of key objects. The
secret field is absent from every item.List your keys
Revoke a key
Permanently deactivates a key. The key stops working on the very next request — there is no grace period. You can revoke your own keys. Admins can revoke any key in the organization.POST /api/keys/:apiKeyId/revoke
string
required
The
id of the key to revoke, from the list or the creation response.revoked_at set.
Revoke a key
Revocation is permanent and immediate. A revoked key cannot be re-activated. If you need the same scope again, mint a new key.
Using a key
Pass the key in theAuthorization header on every request:
POST /v1/traces), use the same header. Configure your OpenTelemetry exporter’s headers to include it:
Example: set key for telemetry exporter
When setting keys in environment variables passed to OpenTelemetry SDKs, encode the space between
Bearer and the key value as %20. Many SDKs pass header values verbatim, and a literal space is not valid in an HTTP header value.