API Keys API Reference

API keys allow your application to authenticate against the Swisstools Feature Flags SDK endpoint (GET /api/flags/:recordId) without a user session. Each key is scoped to the project it was created in — it can only resolve flag values for records that belong to that project. The raw key value is returned only once at creation time and is never retrievable again. After creation, the dashboard shows only a short prefix (e.g., fk_2a9bX1c…) so you can identify keys without exposing the full secret. All API key management endpoints require session authentication. See Authentication for details.

List API Keys

GET /api/projects/:projectId/api-keys Returns all API keys for the project. The rawKey field is not included in list responses — only the prefix and metadata are returned. Path Parameters

string

required

The project’s public reference ID (KSUID), shown in Project settings → General.

Request

curl https://swisstools.dev/api/projects/3DS7IwHB2HHfSP61DzDHVTXt7KK/api-keys \
  -b cookies.txt

Response

[
  {
    "id": "018ec2ad-9e1f-5a6b-c7d8-0e1f2a3b4c5d",
    "projectId": "018e5a3b-2d4e-8c9f-a0b1-3c4d5e6f7a8b",
    "name": "Production",
    "keyPrefix": "fk_2a9bX1c",
    "expiresAt": null,
    "lastUsedAt": "2024-04-01T14:22:00.000Z",
    "revokedAt": null,
    "createdAt": "2024-02-20T10:00:00.000Z"
  }
]

Create API Key

POST /api/projects/:projectId/api-keys Creates a new API key for the project and returns the full key value. Store it immediately — this is the only time the complete key is shown. Path Parameters

string

required

The project’s public reference ID (KSUID), shown in Project settings → General.

Request Body

string

required

A label for the key (e.g., Production, CI, Staging). Helps you identify keys in the dashboard.

string

Optional ISO 8601 expiration timestamp. Omit or send null for a key that never expires; past timestamps are rejected with 400.

Request

curl -X POST https://swisstools.dev/api/projects/3DS7IwHB2HHfSP61DzDHVTXt7KK/api-keys \
  -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{"name": "Production", "expiresAt": "2026-06-07T00:00:00.000Z"}'

Response — 201 Created

{
  "id": "018ec2ad-9e1f-5a6b-c7d8-0e1f2a3b4c5d",
  "projectId": "018e5a3b-2d4e-8c9f-a0b1-3c4d5e6f7a8b",
  "name": "Production",
  "rawKey": "fk_2a9bX1c0d3e4f5g6h7i8j9k0",
  "keyPrefix": "fk_2a9bX1c",
  "expiresAt": null,
  "lastUsedAt": null,
  "revokedAt": null,
  "createdAt": "2024-02-20T10:00:00.000Z"
}

The key field is returned only in this creation response. Swisstools stores only a hash of the key and cannot recover the original value. Copy it to a secure location (such as a secrets manager or environment variable) before leaving this screen.

Revoke API Key

DELETE /api/projects/:projectId/api-keys/:keyId Immediately revokes the key. Any requests made with this key after revocation will be rejected with 401 Unauthorized. This action cannot be undone — create a new key if you need to replace it. Path Parameters

string

required

The project’s public reference ID (KSUID), shown in Project settings → General.

string

required

The id (UUID) of the API key to revoke, from the list response.

Request

curl -X DELETE https://swisstools.dev/api/projects/3DS7IwHB2HHfSP61DzDHVTXt7KK/api-keys/018ec2ad-9e1f-5a6b-c7d8-0e1f2a3b4c5d \
  -b cookies.txt

Response

{"success": true}

API Key Object

string

UUID that uniquely identifies the API key record. Used as :keyId when revoking.

string

Internal ID of the project this key is scoped to.

string

The label you gave the key when you created it.

string

The full API key string, prefixed with fk_. Only present in the creation response.

string

The first 10 characters of the key (e.g., fk_2a9bX1c). Shown in list responses to help identify keys without exposing the secret.

string

ISO 8601 timestamp when the key expires, or null if it never expires.

string

ISO 8601 timestamp of the most recent authenticated request using this key, or null if the key has never been used.

string

ISO 8601 timestamp of when the key was revoked, or null if it is still active.

string

ISO 8601 timestamp of when the key was created.

Overview

Endpoints

API Keys API Reference

List API Keys

Create API Key

Revoke API Key

API Key Object

​List API Keys

​Create API Key

​Revoke API Key

​API Key Object

List API Keys

Create API Key

Revoke API Key

API Key Object