API Keys
Programmatic API key management.
You can manage API keys from code, not just the dashboard. Use these endpoints to provision keys for customers, rotate them in CI, or revoke a leaked key automatically.
List keys
curl https://api.throughputs.dev/v1/keys \
-H "Authorization: Bearer $THROUGHPUTS_ADMIN_KEY"Listing keys requires a key with the admin scope — not just full. Use
a separate admin key kept in a secrets manager, never in app code.
Returns the metadata for each key — never the secret. Secrets are only visible once, at creation time.
type KeyList = {
data: Array<{
id: string; // key_id, used for revocation
name: string;
scope: "full" | "read-only" | "completions-only" | "admin";
createdAt: string; // ISO 8601
lastUsedAt: string | null;
revokedAt: string | null;
spendUsd: number; // lifetime spend on this key
}>;
};Create a key
curl https://api.throughputs.dev/v1/keys \
-H "Authorization: Bearer $THROUGHPUTS_ADMIN_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "prod-backend",
"scope": "completions-only",
"spendLimitUsd": 500
}'type KeyCreateResponse = {
id: string;
secret: string; // thp_live_xxx — only visible here
name: string;
scope: string;
createdAt: string;
};The secret is returned exactly once. Store it immediately in your
secrets manager — THROUGHPUTS cannot recover it if you lose it.
Revoke a key
curl -X DELETE https://api.throughputs.dev/v1/keys/key_abc123 \
-H "Authorization: Bearer $THROUGHPUTS_ADMIN_KEY"Revocation is immediate. Outstanding requests on the revoked key fail with
401 within a few seconds.
Spend limits
Pass spendLimitUsd at creation to cap lifetime spend on a key. When a key
hits its cap, requests start returning 402 Payment Required. Update the
cap with PATCH /v1/keys/{id}.
| Operation | Endpoint |
|---|---|
| List | GET /v1/keys |
| Create | POST /v1/keys |
| Get | GET /v1/keys/{id} |
| Update | PATCH /v1/keys/{id} |
| Revoke | DELETE /v1/keys/{id} |