> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blnkfinance.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Manage API Keys
> List, revoke, and delegate API keys to keep your Blnk deployment secure over time.
export const CtaCallout = props => {
const {title, buttonLabel, href, trackingEvent, buttonTarget, rel = "noopener noreferrer", children} = props;
const handleCtaClick = () => {
if (typeof window === "undefined" || !trackingEvent) {
return;
}
try {
window.dispatchEvent(new CustomEvent("blnk:docs-cta", {
detail: {
name: trackingEvent,
href
}
}));
} catch {}
try {
window.posthog?.capture?.(trackingEvent, {
href
});
} catch {}
const gaPayload = {
cta_href: href
};
try {
window.gtag?.("event", trackingEvent, gaPayload);
} catch {}
try {
window.dataLayer = window.dataLayer || [];
window.dataLayer.push({
event: trackingEvent,
...gaPayload
});
} catch {}
};
const isExternal = typeof href === "string" && (/^https?:\/\//i).test(href);
const target = buttonTarget ?? (isExternal ? "_blank" : undefined);
const linkRel = isExternal ? rel : undefined;
return ;
};
After you create a scoped key, you'll audit what's active, revoke keys you no longer need, and rotate keys before they expire.
If you haven't created a key yet, start with [Scoped API keys](/api-keys/overview).
Listing, revoking, and delegating keys requires the master key or a scoped key with the matching `api-keys:*` scopes. See [Scopes](/api-keys/scopes) for permissions and [Owner context](/api-keys/owner-context) for which keys a caller can manage.
***
## List keys
List keys for an owner to see what's active. The plaintext `key` value is never returned. You get metadata such as name, scopes, expiry, and last-used timestamp.
```bash cURL wrap theme={"system"}
curl -X GET "http://localhost:5001/api-keys?owner=payments-team" \
-H "X-blnk-key: "
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.list({
owner: 'payments-team',
});
```
```json 200 OK wrap theme={"system"}
[
{
"api_key_id": "api_key_879f0ecb-e29f-4137-801b-1048366381db",
"name": "Payments Service",
"owner_id": "payments-team",
"scopes": ["transactions:write", "balances:read"],
"expires_at": "2027-06-13T00:00:00Z",
"created_at": "2026-06-13T10:30:00Z",
"last_used_at": "2026-06-13T14:22:00Z"
}
]
```
***
## Revoke a key
Revoke a key when it's no longer needed or you suspect it was exposed.
```bash cURL wrap theme={"system"}
curl -X DELETE "http://localhost:5001/api-keys/api_key_879f0ecb-e29f-4137-801b-1048366381db?owner=payments-team" \
-H "X-blnk-key: "
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.delete(
'api_key_879f0ecb-e29f-4137-801b-1048366381db',
{
owner: 'payments-team',
},
);
```
A successful revoke returns `204 No Content` with an empty body. The key stops working on the next request.
Revoking a key takes effect immediately. Deploy a replacement key before revoking the old one.
***
## Delegate key creation
Available on Blnk Core 0.14.3 and later.
A scoped key with `api-keys:write` can create narrower keys for its own owner, as long as it only grants scopes it already holds.
See [Owner context](/api-keys/owner-context) for inheritance and cross-owner rules.
```bash cURL wrap theme={"system"}
curl -X POST "http://localhost:5001/api-keys" \
-H "X-blnk-key: " \
-H "Content-Type: application/json" \
-d '{
"name": "Nightly Reconciliation Job",
"owner": "payments-team",
"scopes": ["reconciliation:read"],
"expires_at": "2027-01-01T00:00:00Z"
}'
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.create({
name: 'Nightly Reconciliation Job',
owner: 'payments-team',
scopes: ['reconciliation:read'],
expires_at: '2027-01-01T00:00:00Z',
});
```
***
## Rotate a key
Create a new key with the same scopes or tighter ones:
```bash cURL wrap theme={"system"}
curl -X POST "http://localhost:5001/api-keys" \
-H "X-blnk-key: " \
-H "Content-Type: application/json" \
-d '{
"name": "Payments Service",
"owner": "payments-team",
"scopes": ["transactions:write", "balances:read"],
"expires_at": "2027-06-13T00:00:00Z"
}'
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.create({
name: 'Payments Service',
owner: 'payments-team',
scopes: ['transactions:write', 'balances:read'],
expires_at: '2027-06-13T00:00:00Z',
});
```
Copy the plaintext `key` value from the response immediately. You won't see it again.
Deploy the new key to your secret manager or environment variables. Verify the service works with the new key.
Delete the old key:
```bash cURL wrap theme={"system"}
curl -X DELETE "http://localhost:5001/api-keys/api_key_879f0ecb-e29f-4137-801b-1048366381db?owner=payments-team" \
-H "X-blnk-key: "
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.delete(
'api_key_879f0ecb-e29f-4137-801b-1048366381db',
{
owner: 'payments-team',
},
);
```
Confirm your applications no longer reference the old key.
List keys for the owner and confirm only the expected keys remain active:
```bash cURL wrap theme={"system"}
curl -X GET "http://localhost:5001/api-keys?owner=payments-team" \
-H "X-blnk-key: "
```
```typescript TypeScript wrap theme={"system"}
const response = await blnk.ApiKeys.list({
owner: 'payments-team',
});
```
***
## Security best practices
* Review your key list regularly. Look for keys with broad scopes, keys that haven't been used recently, and keys approaching their expiry date.
* Create a separate key for each service or environment.
* Set expiration dates and grant the minimum scopes. See [Scopes](/api-keys/scopes) before each create.
* Store keys in a secret manager. Never commit them to version control.
***
## Error handling
Structured errors are available from Blnk Core 0.15.0 and later.
When a list, create, or revoke request fails validation or owner checks, Blnk returns `400 Bad Request` or `404 Not Found`.
| Code | When it happens |
| :---------------------- | :--------------------------------------------------------------------------- |
| `APIKEY_INVALID` | The create request failed validation. |
| `APIKEY_OWNER_REQUIRED` | The master key was used to create or list keys without an `owner` parameter. |
| `APIKEY_NOT_FOUND` | The key ID is not found in the caller's owner context. |
```json 400 Bad Request wrap theme={"system"}
{
"error": "owner is required",
"error_detail": {
"code": "APIKEY_OWNER_REQUIRED",
"message": "owner is required"
}
}
```
To resolve the error:
| Code | What to do |
| :---------------------- | :-------------------------------------------------------------------------------------------------------------------------------- |
| `APIKEY_OWNER_REQUIRED` | Add the `owner` query parameter or body field when using the master key. |
| `APIKEY_INVALID` | Fix the validation issue in the create request (missing fields, invalid scopes, or malformed dates). |
| `APIKEY_NOT_FOUND` | Verify the key ID and that it belongs to the owner you're acting on. See [Owner context](/api-keys/owner-context#error-handling). |
Delegation and cross-owner errors are covered in [Owner context](/api-keys/owner-context#error-handling). Permission errors for missing scopes are covered in [Scopes](/api-keys/scopes#error-handling).
***
## Related docs
Create and use scoped keys.
Pick the right permissions.
How Blnk isolates key management.
***
## Need help?
We are very happy to help you make the most of Blnk, regardless of whether it is your first time or you are switching from another tool.
To ask questions or discuss issues, please [contact us](mailto:support@blnkfinance.com) or [join our Discord community](https://discord.gg/7WNv94zPpx).
Sign up and manage your ledger with our back-office dashboard. You can invite teammates to collaborate and manage your ledger operations directly from the dashboard.