Skip to main content

Issue an API key

POST 
/admin/tenants/:id/keys

The plaintext key is in this response and nowhere else, ever. Only its SHA-256 is stored; it is not logged, not mailed and not recoverable. A client that does not show it here has issued a key nobody can use.

This is the credential a casino's backend authenticates the server-to-server API with. It has casino-wide reach and must never reach a browser.

apikeys.write is a permission of its own rather than part of tenants.write: renaming a casino and minting the credential its backend authenticates with are not the same act. Admin gets the read half; owner gets both.

The issuer is taken from the SESSION and recorded on the key. It cannot be named in the body — an actor a client could choose is not an audit trail.

Permission: apikeys.write

Request​

Responses​

Issued — plaintextKey is shown once