API Key Management

Create, scope, rotate, and safely distribute Keymint API keys.

API keys authenticate requests to the Keymint REST API. Create them in Developer → API Keys and choose the narrowest scope for the job.

Scopes

Scope	Intended use
`client`	Applications that activate/deactivate a device or use floating sessions.
`read-only`	Server-side reporting and license/customer reads.
`admin`	Server-side key, customer, product, and configuration management.

Never ship an admin or read-only key in a desktop app, browser bundle, or mobile application. Use a client key for runtime licensing.

Product binding

An API key may be restricted to one product. Product-scoped keys cannot read or mutate another product, even when the caller knows its ID.

Expiration and IP allowlists

Set an expiration date for temporary or customer-specific keys. An optional IP allowlist rejects requests originating outside the listed addresses. Use allowlists for trusted servers and rotate keys when network boundaries change.

Safe rotation

Create a replacement key with the same scope and restrictions.
Deploy the replacement to your server or application.
Confirm requests are succeeding.
Revoke the old key.

The raw secret is shown only once. Store it in a secret manager and do not log it. The dashboard shows metadata such as scope, last-used time, and expiration, not the secret again.

Authentication

bash

curl https://api.keymint.dev/key \
  -H "Authorization: Bearer $KEYMINT_API_KEY"

See Authentication and Rate Limits for request requirements and limits.