SignalCreate and revoke API keys
Manage up to ten account-level keys, copy their full value once, and revoke integrations when access is no longer needed.
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | Yes | For POST /api/keys only: descriptive nonempty label, maximum 60 characters. |
Create a key
POST /api/keys accepts a nonempty name of at most 60 characters. The response uses HTTP 201 and includes the full secret only on creation. Copy it into a server secret store immediately. The example contains a placeholder, not a working key.
{
"id": "example-key-id",
"key": "ss_live_REPLACE_WITH_CREATED_SECRET",
"name": "Agency reporting",
"message": "Copy now. The full key is only shown once."
}Create request
Authenticate with an existing account session or trusted account-level key. A key can create other keys, so treat the management API with the same care as your dashboard.
curl "$SIGNALSHELF_BASE_URL/api/keys" \
-H "Content-Type: application/json" \
-H "x-api-key: $SIGNALSHELF_API_KEY" \
--data '{"name":"Agency reporting"}'// Run in a server environment. Never expose the key in client-side code.
const response = await fetch(`${process.env.SIGNALSHELF_BASE_URL}/api/keys`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-api-key': process.env.SIGNALSHELF_API_KEY,
},
body: JSON.stringify({"name":"Agency reporting"}),
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error?.code}: ${result.error?.message}`);
console.log(result);# Server-side Python; install requests if needed.
import os
import requests
response = requests.post(
os.environ['SIGNALSHELF_BASE_URL'] + "/api/keys",
headers={'x-api-key': os.environ['SIGNALSHELF_API_KEY']},
json={'name': 'Agency reporting'},
timeout=45,
)
result = response.json()
response.raise_for_status()
print(result)List keys
GET /api/keys returns keys with id, name, prefix, and created_at, ordered newest first. It never returns recoverable secret values. At most ten keys may exist per account; revoke an unused key before adding another.
Revoke access
DELETE /api/keys/{id} returns success true when the account-owned key is removed. It takes effect for subsequent authentication attempts. Unknown keys or another account’s key ID return 404. Key revocation does not cancel an already running lookup or sign out browser sessions.
Rotation and limits
Create a replacement, update the server integration, verify it with GET /api/me, then revoke the old key. All keys share the same account balance and saved data. Per-key spending caps, expiry dates, and granular scopes are not available in this beta.