client.api_keys lists and streams API key metadata and generates local Ed25519 keypairs. Methods
are authenticated and account-scoped (account / sub_account_id).
The secret half of a keypair is generated locally and never leaves your process. You send only the public key when creating a key elsewhere (app / TypeScript session client).
Methods (API-key SDK)
| Method | Summary |
|---|---|
generate_keypair | Local Ed25519 keypair. Never sends the secret. |
list | List non-revoked keys. Needs a session. |
get | Fetch one key by ak_... id. Needs a session. |
subscribe | Stream private key updates. |
There is no create / update / delete on this SDK. Creating or revoking keys is a
JWT/session product flow (TypeScript / browser), often with MFA step-up.
Generate keypair
pair = client.api_keys.generate_keypair()
# pair.public_key_hex / pair.secret_key_hex, persist secret yourselfList and get
list and get need an interactive session token, and this SDK authenticates with an API key
only. The server refuses an API key with AUTH_SESSION_KIND_NOT_ALLOWED, which the SDK raises as PolyesterSessionRequiredError. List and inspect keys in the Polyester app or with the TypeScript
SDK on a session.
from polyester import PolyesterSessionRequiredError
try:
keys = await client.api_keys.list()
for key in keys.api_keys:
print(key.key_id, key.label, key.status)
one = await client.api_keys.get(key_id="ak_...")
except PolyesterSessionRequiredError:
print("Listing API keys needs a session; use the Polyester app.")Subscribe
Channel private:auth:api-keys:{account_id}:proto. Needs API key + Account ID.
The API key must include the API-key administration read permission. The method returns only after
the subscription-token request and Centrifugo handshake succeed.
sub = await client.api_keys.subscribe(account_id=client.default_account_id)
async with sub:
async for key in sub:
print(key.key_id, key.status)
break