fingerlydocs
fingerly.io Log inDashboard
API reference

SDK keys

List, issue and revoke public and secret SDK keys, and replace a public key's allowed origins, with a management key.

Manage the public and secret keys your SDKs and servers use. Admin and developer management keys can do all of this. See API keys and environments for what each kind of key is for.

Path parameter

  • organization_idstringrequired
    Your organization, from Describe the key. A path naming any other organization answers 404.

List SDK keys

GET/api/v1/management/organizations/{organization_id}/sdk-keys Management key

Every key in every environment, oldest first, revoked keys included.

Response

  • keysSDKKey[]
    The keys.
    15 child fields
    • idstring
      The key's ID.
    • namestring
      The key's name.
    • kindstring
      public or secret.
    • environmentstring
      production, staging or development.
    • regionstring
      The data region whose API accepts the key.
    • prefixstring
      The start of the secret, such as fly_pk_us_production.
    • last4string
      The last four characters of the secret.
    • allowed_originsstring[]
      The origins a public key is accepted from in browsers. Always empty for a secret key.
    • statusstring
      active or revoked.
    • last_used_atstring
      When the key last authenticated a request. Omitted if never.
    • expires_atstring
      When the key stops working. Omitted if it does not expire.
    • created_atstring
      When the key was issued.
    • created_bystring
      The member who issued it. Omitted for a key issued with a management key.
    • revoked_atstring
      When the key was revoked.
    • revoked_bystring
      The member who revoked it. Omitted when a management key did.

Issue an SDK key

POST/api/v1/management/organizations/{organization_id}/sdk-keys Management key

Body

  • namestringrequired
    What the key is called.
  • kindstringrequired
    public or secret.
  • environmentstringrequired
    production, staging or development.
  • allowed_originsstring[]
    Required, with at least one origin, for a public key. Refused on a secret key.
  • expires_atstring
    When the key stops working, RFC 3339. Omit for a key that lasts until revoked.

Answers 201 with key, an SDK key as above, and secret, the whole key. The secret is never returned again.

Revoke an SDK key

POST/api/v1/management/organizations/{organization_id}/sdk-keys/{sdk_key_id}/revoke Management key

Refuses the key from the next request on, and answers with the revoked key. There is no undo. Revoking a key that is already revoked answers 409 with key_revoked.

Replace allowed origins

PUT/api/v1/management/organizations/{organization_id}/sdk-keys/{sdk_key_id}/origins Management key

Body

  • allowed_originsstring[]required
    The complete new list. Each origin is a scheme, a host and an optional port, with no path. An empty list refuses every browser request.

Replaces the list rather than adding to it, and answers with the key. Refused with 422 on a secret key.

Last updated