Manage API keys in Ory Talos Secure API Keys
Ory Talos Secure API Keys on Ory Network is in preview. The HTTP API is versioned v2alpha1, and request and response shapes can
change. Pin the version of the Ory SDK that you use.
Ory Talos Secure API Keys issues and verifies the API keys that your customers use to call your API. The pages in this section show how to manage those keys on Ory Network over their lifetime: issue, view, edit, rotate, revoke, and import them. You can do each task in the Ory Console, or through the HTTP API and the Ory SDK.
Tasks at a glance
The Ory Console pages for these tasks are in the API Keys section of the project navigation. All API paths are relative to
https://$PROJECT_SLUG.projects.oryapis.com. The SDK methods belong to ApiKeysApi in the TypeScript SDK (@ory/client). In the
Go SDK (github.com/ory/client-go), the service is ApiKeysAPI and each method name starts with an uppercase letter, for example
AdminIssueApiKey.
| Task | Ory Console | HTTP API | SDK method |
|---|---|---|---|
| Issue a key | Keys page, Create API key | POST /v2alpha1/admin/issuedApiKeys | adminIssueApiKey |
| List keys | Keys page | GET /v2alpha1/admin/issuedApiKeys | adminListIssuedApiKeys |
| View a key | Keys page, row menu, View details | GET /v2alpha1/admin/issuedApiKeys/{key_id} | adminGetIssuedApiKey |
| Edit a key | Key detail page, Save changes | PATCH /v2alpha1/admin/issuedApiKeys/{key_id} | adminUpdateIssuedApiKey |
| Rotate a key | Keys page, row menu, Rotate | POST /v2alpha1/admin/issuedApiKeys/{key_id}:rotate | adminRotateIssuedApiKey |
| Revoke a key | Keys page, row menu, Revoke | POST /v2alpha1/admin/issuedApiKeys/{key_id}:revoke | adminRevokeIssuedApiKey |
| Import a key | Imported page, Import key | POST /v2alpha1/admin/importedApiKeys | adminImportApiKey |
| Import up to 1,000 keys | API only | POST /v2alpha1/admin/importedApiKeys:batchCreate | adminBatchCreateImportedApiKeys |
| List imported keys | Imported page | GET /v2alpha1/admin/importedApiKeys | adminListImportedApiKeys |
| View an imported key | Imported page, row menu, View / Edit | GET /v2alpha1/admin/importedApiKeys/{key_id} | adminGetImportedApiKey |
| Edit an imported key | Imported key detail page, Save changes | PATCH /v2alpha1/admin/importedApiKeys/{key_id} | adminUpdateImportedApiKey |
| Revoke an imported key | Imported page, row menu, Revoke | POST /v2alpha1/admin/importedApiKeys/{key_id}:revoke | adminRevokeImportedApiKey |
| Delete an imported key | Imported page, row menu, Delete | DELETE /v2alpha1/admin/importedApiKeys/{key_id} | adminDeleteImportedApiKey |
| Test verification | Playground page, Verify | POST /v2alpha1/admin/apiKeys:verify | adminVerifyApiKey |
| Test token derivation | Playground page, Derive token | POST /v2alpha1/admin/apiKeys:derive | adminDeriveToken |
Active key limit
The number of active API keys in a project depends on the plan, and issued and imported keys both count toward it. A project on the Develop plan can hold up to 50 active keys, and a project on the Production plan up to 1,000. The Growth and Enterprise plans have no fixed limit. See Ory pricing.
- Expired keys count toward the limit until you revoke them. You can also delete expired imported keys.
- Revoking a key frees its slot. Rotating a key doesn't change the count.
- When the project reaches the limit, issuing or importing a key fails with HTTP 402.
To find expired keys, compare the expire_time of each key with the current time. In the Ory Console, check the Expires
column.