API keys

3 endpoints · base URL https://papaproxy.net/account_new · authentication

GETList API keys
POSTCreate an API key
DELETERevoke an API key

List API keys

GET/api/v1/customers/me/api-keys

API key required

List your API keys. Works only in a signed-in Dashboard session; a request made with an API key returns 403.

Request example Try it in the Dashboard

cURL

curl -X GET "https://papaproxy.net/account_new/api/v1/customers/me/api-keys" \
  -H "Authorization: Bearer $PAPAPROXY_API_KEY"

Python

import os

import requests

resp = requests.get(
    "https://papaproxy.net/account_new/api/v1/customers/me/api-keys",
    headers={"Authorization": f"Bearer {os.environ['PAPAPROXY_API_KEY']}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

Node.js

const resp = await fetch("https://papaproxy.net/account_new/api/v1/customers/me/api-keys", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAPAPROXY_API_KEY}`,
  },
});
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
console.log(await resp.json());

PHP

<?php
$ch = curl_init('https://papaproxy.net/account_new/api/v1/customers/me/api-keys');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('PAPAPROXY_API_KEY'),
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
var_dump($status, json_decode($response, true));

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest("GET", "https://papaproxy.net/account_new/api/v1/customers/me/api-keys", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("PAPAPROXY_API_KEY"))
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}

Responses

200 Your API keys (the secret itself is never returned again). · 9 fields

Example response · JSON

[
  {
    "id": "ab1deea7-362b-5dd5-83b7-0a58f0c819a0",
    "name": "ci-deploy",
    "key_prefix": "fb_4f1c9a7e2",
    "scopes": [],
    "is_active": false,
    "created_at": "2026-11-07T14:14:53.656051Z",
    "last_used_at": "2026-11-07T14:14:55.980597Z",
    "last_used_ip": "198.51.100.24",
    "expires_at": null
  },
  {
    "id": "29066e86-06b5-5c5f-9576-519cf1dc2fb8",
    "name": "ci-deploy",
    "key_prefix": "fb_4f1c9a7e2",
    "scopes": [],
    "is_active": false,
    "created_at": "2026-11-07T14:09:29.016284Z",
    "last_used_at": null,
    "last_used_ip": null,
    "expires_at": null
  }
]

Field	Type	Description
`[].id` required	string (uuid)	Unique ID.
`[].name` required	string
`[].key_prefix` required	string	First characters of the key, to tell keys apart.
`[].scopes` required	array of string	Scopes granted to the key.
`[].is_active` required	boolean	Whether it's active.
`[].created_at` required	string (date-time)	When it was created (ISO 8601, UTC).
`[].last_used_at`	string (date-time), nullable	When the key was last used (ISO 8601, UTC).
`[].last_used_ip`	string, nullable	IP address the key was last used from.
`[].expires_at`	string (date-time), nullable	When the current term ends (ISO 8601, UTC).

401 The API key is missing, malformed, revoked, or expired, or the account is inactive.
Example · JSON
```
{
  "detail": "Invalid or revoked API key."
}
```
Error format
403 The request was made with an API key. Manage keys in the Dashboard.
Example · JSON
```
{
  "detail": "api_key_management_requires_session"
}
```
Error format
429 Too many requests: the per-account limit is 60 requests per minute, shared by all keys and the MCP server. Retry with exponential backoff.
Example · JSON
```
{
  "detail": "Too Many Requests"
}
```
Error format

Create an API key

POST/api/v1/customers/me/api-keys

API key required

Create an API key with the given scopes. The secret is returned only once, in this response, so store it securely. Works only in a signed-in Dashboard session; a request made with an API key returns 403.

Request body

Field	Type	Description
`name` required	string	Min length: 1Max length: 255
`scopes` required	array of string	Scopes granted to this key.Min items: 1

Request example Try it in the Dashboard

cURL

curl -X POST "https://papaproxy.net/account_new/api/v1/customers/me/api-keys" \
  -H "Authorization: Bearer $PAPAPROXY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-key", "scopes": ["services:read", "wallet:read"]}'

Python

import os

import requests

resp = requests.post(
    "https://papaproxy.net/account_new/api/v1/customers/me/api-keys",
    headers={"Authorization": f"Bearer {os.environ['PAPAPROXY_API_KEY']}"},
    json={
        "name": "my-key",
        "scopes": [
            "services:read",
            "wallet:read"
        ]
    },
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

Node.js

const resp = await fetch("https://papaproxy.net/account_new/api/v1/customers/me/api-keys", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAPAPROXY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "my-key",
    "scopes": [
      "services:read",
      "wallet:read"
    ]
  }),
});
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
console.log(await resp.json());

PHP

<?php
$ch = curl_init('https://papaproxy.net/account_new/api/v1/customers/me/api-keys');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('PAPAPROXY_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'name' => 'my-key',
        'scopes' => ['services:read', 'wallet:read']
    ]),
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
var_dump($status, json_decode($response, true));

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
)

func main() {
	req, err := http.NewRequest("POST", "https://papaproxy.net/account_new/api/v1/customers/me/api-keys", strings.NewReader(`{"name": "my-key", "scopes": ["services:read", "wallet:read"]}`))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("PAPAPROXY_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}

Responses

201 Returned once on creation — includes the raw key (shown only here). · 10 fields

Example response · JSON

{
  "id": "3aeee9b3-41a1-5a66-a735-a475b0aebe55",
  "name": "ci-deploy",
  "key_prefix": "fb_4f1c9a7e2",
  "scopes": [
    "services:read"
  ],
  "is_active": true,
  "created_at": "2026-11-07T14:31:35.953143Z",
  "last_used_at": null,
  "last_used_ip": null,
  "expires_at": null,
  "api_key": "fb_4f1c9a7e2b6d80534f1c9a7e2b6d80534f1c9a7e2b6d80534f1c9a7e2b6d8053"
}

Field	Type	Description
`id` required	string (uuid)	Unique ID.
`name` required	string
`key_prefix` required	string	First characters of the key, to tell keys apart.
`scopes` required	array of string	Scopes granted to the key.
`is_active` required	boolean	Whether it's active.
`created_at` required	string (date-time)	When it was created (ISO 8601, UTC).
`last_used_at`	string (date-time), nullable	When the key was last used (ISO 8601, UTC).
`last_used_ip`	string, nullable	IP address the key was last used from.
`expires_at`	string (date-time), nullable	When the current term ends (ISO 8601, UTC).
`api_key` required	string	Full secret key — shown ONCE, store it now

401 The API key is missing, malformed, revoked, or expired, or the account is inactive.
Example · JSON
```
{
  "detail": "Invalid or revoked API key."
}
```
Error format
403 The request was made with an API key. Manage keys in the Dashboard.
Example · JSON
```
{
  "detail": "api_key_management_requires_session"
}
```
Error format
422 Validation error: a field is missing or has the wrong type or value.
Example · JSON
```
{
  "detail": "Validation error"
}
```
Error format
429 Too many requests: the per-account limit is 60 requests per minute, shared by all keys and the MCP server. Retry with exponential backoff.
Example · JSON
```
{
  "detail": "Too Many Requests"
}
```
Error format

Revoke an API key

DELETE/api/v1/customers/me/api-keys/{key_id}

API key required

Revoke one of your API keys. Requests made with it fail immediately afterward. Works only in a signed-in Dashboard session; a request made with an API key returns 403.

Parameters

Field	Type	Description
`key_id (path)` required	string (uuid)	ID of the api key.

Request example Try it in the Dashboard

cURL

curl -X DELETE "https://papaproxy.net/account_new/api/v1/customers/me/api-keys/3fa85f64-5717-4562-b3fc-2c963f66afa6" \
  -H "Authorization: Bearer $PAPAPROXY_API_KEY"

Python

import os

import requests

resp = requests.delete(
    "https://papaproxy.net/account_new/api/v1/customers/me/api-keys/3fa85f64-5717-4562-b3fc-2c963f66afa6",
    headers={"Authorization": f"Bearer {os.environ['PAPAPROXY_API_KEY']}"},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

Node.js

const resp = await fetch("https://papaproxy.net/account_new/api/v1/customers/me/api-keys/3fa85f64-5717-4562-b3fc-2c963f66afa6", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.PAPAPROXY_API_KEY}`,
  },
});
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
console.log(await resp.json());

PHP

<?php
$ch = curl_init('https://papaproxy.net/account_new/api/v1/customers/me/api-keys/3fa85f64-5717-4562-b3fc-2c963f66afa6');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('PAPAPROXY_API_KEY'),
    ],
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
var_dump($status, json_decode($response, true));

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest("DELETE", "https://papaproxy.net/account_new/api/v1/customers/me/api-keys/3fa85f64-5717-4562-b3fc-2c963f66afa6", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("PAPAPROXY_API_KEY"))
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}

Responses

200 Generic message response. · 1 fields
Example response · JSON
```
{
  "message": "API key revoked."
}
```
Field Type Description
message required string
401 The API key is missing, malformed, revoked, or expired, or the account is inactive.
Example · JSON
```
{
  "detail": "Invalid or revoked API key."
}
```
Error format
403 The request was made with an API key. Manage keys in the Dashboard.
Example · JSON
```
{
  "detail": "api_key_management_requires_session"
}
```
Error format
404 API key not found, or it doesn't belong to your account. — error format
422 Validation error: a field is missing or has the wrong type or value.
Example · JSON
```
{
  "detail": "Validation error"
}
```
Error format
429 Too many requests: the per-account limit is 60 requests per minute, shared by all keys and the MCP server. Retry with exponential backoff.
Example · JSON
```
{
  "detail": "Too Many Requests"
}
```
Error format

Field	Type	Description
`message` required	string

Last updated: November 9, 2026. Generated from the OpenAPI 3.1 specification (API version 0.1.0). Markdown version for AI agents.