[{"data":1,"prerenderedAt":153},["ShallowReactive",2],{"doc:\u002Freference\u002Fmanagement\u002Fsdk-keys":3},{"page":4,"toc":147,"updated":152},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9,"examples":129},"\u002Freference\u002Fmanagement\u002Fsdk-keys","SDK keys","Management API: SDK Keys","List, issue and revoke public and secret SDK keys, and replace a public key's allowed origins, with a management key.",[10,13,22,27,32,34,88,91,93,104,106,109,111,113,116,119,123,125],{"type":11,"text":12},"p","Manage the public and secret keys your SDKs and servers use. Admin and developer management keys can do all of this. See [API keys and environments](\u002Fdocs\u002Fapi-keys) for what each kind of key is for.",{"type":14,"title":15,"fields":16},"fields","Path parameter",[17],{"name":18,"type":19,"text":20,"required":21},"organization_id","string","Your organization, from [Describe the key](\u002Freference\u002Fmanagement\u002Foverview#describe-the-key). A path naming any other organization answers `404`.",true,{"type":23,"level":24,"text":25,"id":26},"heading",2,"List SDK keys","list-sdk-keys",{"type":28,"method":29,"path":30,"auth":31},"endpoint","GET","\u002Fapi\u002Fv1\u002Fmanagement\u002Forganizations\u002F{organization_id}\u002Fsdk-keys","management",{"type":11,"text":33},"Every key in every environment, oldest first, revoked keys included.",{"type":14,"title":35,"fields":36},"Response",[37],{"name":38,"type":39,"text":40,"children":41},"keys","SDKKey[]","The keys.",[42,45,48,51,54,57,60,63,67,70,73,76,79,82,85],{"name":43,"type":19,"text":44},"id","The key's ID.",{"name":46,"type":19,"text":47},"name","The key's name.",{"name":49,"type":19,"text":50},"kind","`public` or `secret`.",{"name":52,"type":19,"text":53},"environment","`production`, `staging` or `development`.",{"name":55,"type":19,"text":56},"region","The data region whose API accepts the key.",{"name":58,"type":19,"text":59},"prefix","The start of the secret, such as `fly_pk_us_production`.",{"name":61,"type":19,"text":62},"last4","The last four characters of the secret.",{"name":64,"type":65,"text":66},"allowed_origins","string[]","The origins a public key is accepted from in browsers. Always empty for a secret key.",{"name":68,"type":19,"text":69},"status","`active` or `revoked`.",{"name":71,"type":19,"text":72},"last_used_at","When the key last authenticated a request. Omitted if never.",{"name":74,"type":19,"text":75},"expires_at","When the key stops working. Omitted if it does not expire.",{"name":77,"type":19,"text":78},"created_at","When the key was issued.",{"name":80,"type":19,"text":81},"created_by","The member who issued it. Omitted for a key issued with a management key.",{"name":83,"type":19,"text":84},"revoked_at","When the key was revoked.",{"name":86,"type":19,"text":87},"revoked_by","The member who revoked it. Omitted when a management key did.",{"type":23,"level":24,"text":89,"id":90},"Issue an SDK key","issue-an-sdk-key",{"type":28,"method":92,"path":30,"auth":31},"POST",{"type":14,"title":94,"fields":95},"Body",[96,98,99,100,102],{"name":46,"type":19,"text":97,"required":21},"What the key is called.",{"name":49,"type":19,"text":50,"required":21},{"name":52,"type":19,"text":53,"required":21},{"name":64,"type":65,"text":101},"Required, with at least one origin, for a public key. Refused on a secret key.",{"name":74,"type":19,"text":103},"When the key stops working, RFC 3339. Omit for a key that lasts until revoked.",{"type":11,"text":105},"Answers `201` with `key`, an SDK key as above, and `secret`, the whole key. The secret is never returned again.",{"type":23,"level":24,"text":107,"id":108},"Revoke an SDK key","revoke-an-sdk-key",{"type":28,"method":92,"path":110,"auth":31},"\u002Fapi\u002Fv1\u002Fmanagement\u002Forganizations\u002F{organization_id}\u002Fsdk-keys\u002F{sdk_key_id}\u002Frevoke",{"type":11,"text":112},"Refuses the key from the next request on, and answers with the revoked key. There is no undo. Revoking a key that is already revoked answers `409` with `key_revoked`.",{"type":23,"level":24,"text":114,"id":115},"Replace allowed origins","replace-allowed-origins",{"type":28,"method":117,"path":118,"auth":31},"PUT","\u002Fapi\u002Fv1\u002Fmanagement\u002Forganizations\u002F{organization_id}\u002Fsdk-keys\u002F{sdk_key_id}\u002Forigins",{"type":14,"title":94,"fields":120},[121],{"name":64,"type":65,"text":122,"required":21},"The complete new list. Each origin is a scheme, a host and an optional port, with no path. An empty list refuses every browser request.",{"type":11,"text":124},"Replaces the list rather than adding to it, and answers with the key. Refused with `422` on a secret key.",{"type":126,"tone":127,"text":128},"callout","note","To give an SDK key its own risk weights, see [risk weights](\u002Freference\u002Fmanagement\u002Frisk-weights#save-an-sdk-key-s-weights).",{"request":130,"response":139},[131,135],{"label":132,"lang":133,"code":134},"cURL","bash","curl -X POST \"https:\u002F\u002Fus.api.fingerly.io\u002Fapi\u002Fv1\u002Fmanagement\u002Forganizations\u002F01a0a7f2-3c18-7b40-8d2e-5f6a9b1c0d37\u002Fsdk-keys\" \\\n  -H \"x-api-key: $FINGERLY_MANAGEMENT_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Checkout\",\n    \"kind\": \"public\",\n    \"environment\": \"production\",\n    \"allowed_origins\": [\n      \"https:\u002F\u002Fshop.example.com\"\n    ]\n  }'",{"label":136,"lang":137,"code":138},"Node.js script","ts","const api = (path: string, init: RequestInit = {}) =>\n  fetch('https:\u002F\u002Fus.api.fingerly.io\u002Fapi\u002Fv1\u002Fmanagement' + path, {\n    ...init,\n    headers: { 'x-api-key': process.env.FINGERLY_MANAGEMENT_KEY!, 'Content-Type': 'application\u002Fjson' },\n  })\n\nconst { organization_id } = await (await api('\u002Fkey')).json()\nconst { keys } = await (await api('\u002Forganizations\u002F' + organization_id + '\u002Fsdk-keys')).json()\n\nconst active = (key: { name: string; status: string }) => key.name === 'Checkout' && key.status === 'active'\nif (!keys.some(active)) {\n  const created = await api('\u002Forganizations\u002F' + organization_id + '\u002Fsdk-keys', {\n    method: 'POST',\n    body: JSON.stringify({ name: 'Checkout', kind: 'public', environment: 'production', allowed_origins: ['https:\u002F\u002Fshop.example.com'] }),\n  })\n  const { secret } = await created.json()\n  await secrets.put('FINGERLY_PUBLIC_KEY', secret)\n}",[140,144],{"label":141,"lang":142,"code":143},"201","json","{\n  \"key\": {\n    \"id\": \"01a0a7f3-9e05-7a61-b4c7-2d8e0f3a6b19\",\n    \"name\": \"Checkout\",\n    \"kind\": \"public\",\n    \"environment\": \"production\",\n    \"region\": \"us\",\n    \"prefix\": \"fly_pk_us_production\",\n    \"last4\": \"q7Rk\",\n    \"allowed_origins\": [\n      \"https:\u002F\u002Fshop.example.com\"\n    ],\n    \"status\": \"active\",\n    \"created_at\": \"2026-09-16T09:12:40Z\"\n  },\n  \"secret\": \"fly_pk_us_production_…\"\n}",{"label":145,"lang":142,"code":146},"422","{\n  \"error\": {\n    \"code\": \"key_rejected\",\n    \"message\": \"services: the SDK key cannot be issued as described: a public key has to name the origins it may be used from\",\n    \"status\": 422\n  },\n  \"request_id\": \"01a0a84c-0f11-7a3e-9c2d-4b5e6f708192\"\n}",[148,149,150,151],{"id":26,"text":25,"level":24},{"id":90,"text":89,"level":24},{"id":108,"text":107,"level":24},{"id":115,"text":114,"level":24},"2026-09-17T16:56:08.000Z",1789667797861]