account

API key updates

Authenticated API key configuration updates for one root account.

Transport

WebSocket

Encoding

Protobuf

Visibility

Authentication required

Channel

private:auth:api-keys:{rootAccountPublicId}:proto

Subscribe frame

{
  "type": "subscribe",
  "channel": "private:auth:api-keys:3gDmDv6tjHJ:proto"
}

Channel parameters

rootAccountPublicId string

Public root account identifier authorized by the subscription token.

e.g. 3gDmDv6tjHJ

Message

Payload auth.v1.ApiKey

keyId string /^ak_[a…]{32}$/

Stable opaque identifier used to refer to this key, formatted as "ak_" followed by 32 lowercase hex characters.

Example ak_0123456789abcdef0123456789abcdef

label string

Human-readable label for the key. Maximum length is 64 characters.

Example Trading bot

icon string max 32 chars

Optional user-chosen icon/emoji for UI display.

color string (color) max 32 chars

Optional user-chosen color token for UI display.

ipWhitelist string[] max 32 items, unique

Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique entries.

status enum

Current key status.

ACTIVE REVOKED DISABLED

Example ACTIVE

subaccountId string (fixed64)

Optional sub-account this key is scoped to (opaque ID; empty = root-level).

policyId string (fixed64)

Optional API policy attached to this key (opaque ID). Empty means no policy is attached and the key has no permissions.

createdAt string (date-time)

Time in UTC when this key was created.

lastUsedAt string (date-time)

Approximate last time in UTC when this key authenticated a request, recorded at most about once a minute; it may lag recent use by a few minutes. Omitted when no use has been recorded.

publicKeyEd25519 string (byte)

Ed25519 public key bytes associated with this API key. The private key or seed is never returned by the API.

expiresAt string (date-time)

Optional expiry time in UTC. When set, the key cannot authenticate requests after this time, regardless of status.

createdByActor string

Read-only actor label describing who created this key, such as a username or account label.

updatedAt string (date-time)

Time in UTC when this key's configuration was last changed. For the same key, later is fresher, equal is an idempotent replay, and earlier is stale. Equal timestamps with different configuration indicate an invariant failure. This is independent of last_used_at, which tracks authentication activity.

revision string (uint64)

Monotonic resource revision used for conditional updates.