API Key Management
Create and rotate Keymint API keys, choose least-privilege scopes, restrict products and IPs, set expiration, and store raw secrets safely.
API keys authenticate requests to the Keymint REST API. Create them in Developer → API Keys and choose the narrowest scope for the job.
Scopes
| Scope | Intended use |
|---|---|
client | Applications that activate/deactivate a device or use floating sessions. |
read-only | Server-side reporting and license/customer reads. |
admin | Server-side key, customer, product, and configuration management. |
Never ship an admin or read-only key in a desktop app, browser bundle, or mobile application. Use a client key for runtime licensing.
Product binding
An API key may be restricted to one product. Product-scoped keys cannot read or mutate another product, even when the caller knows its ID.
Expiration and IP allowlists
Set an expiration date for temporary or customer-specific keys. An optional IP allowlist rejects requests originating outside the listed addresses. Entries can be IPv4 or IPv6 addresses or CIDR blocks (for example 203.0.113.10, 10.0.0.0/8, 2001:db8:abcd::/48). If your server has both IPv4 and IPv6 connectivity, list both, because requests may arrive over either. Use allowlists for trusted servers and rotate keys when network boundaries change.
Safe rotation
- Create a replacement key with the same scope and restrictions.
- Deploy the replacement to your server or application.
- Confirm requests are succeeding.
- Revoke the old key.
The raw secret is shown only once. Store it in a secret manager and do not log it. The dashboard shows metadata such as scope, last-used time, and expiration, not the secret again.
Authentication
curl https://api.keymint.dev/key \
-H "Authorization: Bearer $KEYMINT_API_KEY"See Authentication and Rate Limits for request requirements and limits.