> ## Documentation Index
> Fetch the complete documentation index at: https://docs.r3al.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Mint, list, and revoke standalone API keys for scripts and integrations.

Standalone API keys are independent of platform accounts -- meant for CI, scripts, or third-party integrations that shouldn't need a login. Minting one (or setting `R3AL_API_KEY`) is also what switches the whole API from open to auth-required; see [Authentication](/api/authentication).

Requires the **Admin** or **Developer** role when called with a session token.

## Create a key

```bash theme={null}
curl -X POST https://platform.r3al.ai/v1/keys \
  -H "Authorization: Bearer <admin or developer credential>" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-pipeline", "env": "prod"}'
```

```json theme={null}
{
  "id": "k_a1b2c3d4e5f6",
  "name": "ci-pipeline",
  "env": "prod",
  "scope": "all",
  "key": "r3l_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "masked": "r3l_live_•••••••e5f6"
}
```

<Warning>
  `key` is the real secret and is only ever returned **once**, in this response. It's stored server-side only as a SHA-256 hash -- there's no way to retrieve it again later, only revoke and mint a new one.
</Warning>

| Field   | Default | Notes                                                                           |
| ------- | ------- | ------------------------------------------------------------------------------- |
| `name`  | --      | Required                                                                        |
| `env`   | `"dev"` | Free-form label; `"prod"` gets an `r3l_live_` prefix, anything else `r3l_test_` |
| `scope` | `"all"` | Free-form label, not currently enforced                                         |

## List keys

```bash theme={null}
curl https://platform.r3al.ai/v1/keys -H "Authorization: Bearer <credential>"
```

```json theme={null}
{
  "keys": [
    {
      "id": "k_a1b2c3d4e5f6",
      "name": "ci-pipeline",
      "env": "prod",
      "scope": "all",
      "masked": "r3l_live_•••••••e5f6",
      "created_at": 1752600000.0,
      "last_used_at": 1752690000.0,
      "call_count": 214
    }
  ],
  "count": 1
}
```

Real, live usage -- `call_count` and `last_used_at` update on every authenticated request that key makes.

## Revoke a key

```bash theme={null}
curl -X DELETE https://platform.r3al.ai/v1/keys/k_a1b2c3d4e5f6 \
  -H "Authorization: Bearer <credential>"
```

Permanently deletes the key (and its usage history). `404` if the id doesn't exist.