Programmatically provision, rotate, and revoke API keys via the management API.
Management (provisioning) keys let you automate API key lifecycle operations — minting keys for new users, rotating them, revoking compromised ones.
Available now in the dashboard. Create and manage them at Settings → Management keys (/dashboard/settings/management-keys): create a named key (the raw mk-… value is shown once at creation — copy it then; only the prefix is shown afterwards), see your keys with their prefix and status, and revoke any of them. They use the same one-way hashing as inference API keys, so the secret is never recoverable after creation.
Authenticate with your management key (Bearer mk-…) to mint, list, and revoke your inference API keys programmatically:
Keys minted this way belong to the management key's owner; the raw inference key is shown only on creation.
The dashboard at /dashboard/keys is the right place for day-to-day key management. The Management API is for:
Management API calls are authenticated with a special management key — distinct from ordinary inference keys. Management keys have elevated permissions and should be stored in a secrets manager, never in application code or environment files alongside inference keys.
Management keys are issued from Settings → Management Keys — the value is shown once at creation.
The management API lives under https://opendunes.com/api/v1/management and supports three operations.
Returns all API keys on your account (metadata only — id, name, key_prefix, status, created_at; the key value is never returned after creation).
Response includes the full key value — store it immediately, it will not be shown again:
Revocation is immediate. Any in-flight request using this key will be rejected with a 401 invalid_api_key error.
There is no update operation — to change a key's configuration, create a replacement and revoke the old one (see the rotation pattern below). Renaming, per-key limits, and expiry are managed from the dashboard at /dashboard/keys.
The safest way to rotate a key is:
POST /api/v1/management/keys to create the new keyDELETE /api/v1/management/keys/{old_id} to revoke the old keyThis is a zero-downtime rotation — both keys are valid during the overlap window.
Management API calls are rate-limited independently from inference. Provisioning at high volume (e.g. creating thousands of keys in a loop) will require contacting support to raise the management limit.