API keys

client.api_keys lists and streams API key metadata and generates local Ed25519 keypairs. Methods are authenticated. Optional subaccount_id scopes list.

Methods (API-key SDK)

There is no create / update / delete on this SDK. Creating or revoking keys is a JWT/session product flow (TypeScript / browser).

Generate keypair

let pair = client.api_keys.generate_keypair();
// pair.public_key_hex / pair.secret_key_hex, persist secret yourself

List and get

list and get need an interactive session token, and this SDK authenticates with an API key only. The server refuses an API key with AUTH_SESSION_KIND_NOT_ALLOWED, which the SDK returns as Error::SessionRequired. List and inspect keys in the Polyester app or with the TypeScript SDK on a session.

match client.api_keys.list(None).await {
    Ok(keys) => {
        for key in &keys.keys {
            println!("{} {} {}", key.key_id, key.label, key.status);
        }
    }
    Err(polyester::Error::SessionRequired { .. }) => {
        println!("Listing API keys needs a session; use the Polyester app.");
    }
    Err(err) => return Err(err.into()),
}

The key_id values on this API-key surface are ak_... credential handles, matching the value used by signing Config.api_key_id. auth.me().api_key_id is instead a base58 public ID; do not compare it directly with these handles.

Subscribe

Requires the API-key administration read permission and an Account ID. The method returns only after the subscription-token request and Centrifugo handshake succeed.

let account = client.default_account_id.as_deref();
let mut sub = client.api_keys.subscribe(account).await?;
while let Some(key) = sub.recv_result().await? {
    println!("{} {}", key.key_id, key.status);
    break;
}

Related

• Authentication guide
• Authentication model

Related Topics