Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAPI Keys

List an org's API keys (no secrets)

Returns the organization's API keys with each key's id, name, prefix, kind, scopes, budget, expiry and last use. The plaintext secret is never returned. With permissions enabled, a caller without apikey.read gets only their own personal keys. Dashboard playground keys are never listed.

Required permission

Checked against the apikey.read permission for the resource it acts on. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl api-keys list
GET
/v1/orgs/{orgId}/api-keys

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

orgId*string

Response Body

API keys

application/json
  1. response
[index: integer]?
Example Request
curl -X GET 'https://api.openrelay.inc/v1/orgs/string/api-keys'
Example Response
[  {    "id": "string",    "name": "string",    "keyPrefix": "string",    "scopes": [      "string"    ],    "lastUsedAt": "string",    "expiresAt": "string",    "revokedAt": "string",    "createdAt": "string",    "kind": "personal",    "ownerUserId": "string",    "restrictions": {      "permissions": [        "string"      ],      "models": [        "string"      ],      "endpoints": [        "string"      ],      "ipRanges": [        "string"      ]    },    "note": "string",    "createdBy": "string",    "budget": {      "limitNanoUsd": 0,      "period": "lifetime",      "spentNanoUsd": 0,      "periodEndsAt": "2019-08-24T14:15:22Z"    }  }]

Overview

Programmatic access keys (or_…; legacy vl_… still valid) used to authenticate with this API. The plaintext is returned once, when the key is created.

Create an API key (returns the plaintext once) POST

Returns the new key's plaintext secret, which is shown only in this response, with its id, prefix, organization id, and any permissions or budget. With permissions enabled, only a signed-in session creates keys, and a new key belongs to the organization (kind org), so it keeps working if its creator leaves; personal and service kinds are refused, except dashboard playground keys, which are always personal. Its permissions come from template or permissions and can never exceed the creator's own access (403 ESCALATION_REFUSED). scopes still works and maps to the key's ceiling. budget caps what the new key may spend on inference per period. A key that carries a budget cannot create keys (403 FORBIDDEN), so it cannot mint itself one without a budget.