API keys

Package: agentrouter.api_keys.v1 Service: ApiKeysService

Endpoints

Create api key

What it does: Creates a new JWT user-token API key for a user and returns the plaintext token exactly once.

Request fields:

FieldRequiredDescription
user_idnoUser ID that will own the API key.
user_key_addressnoUser key address input (typically email or user id). Required for API parity with client flows and request provenance checks. In JWT-based issuance, returned key_address is derived from user_id by the token service.
namenoHuman-readable key name.
enterprise_contextnoOptional enterprise context overrides for JWT user-token issuance. When omitted, service defaults are used.

Response fields:

FieldRequiredDescription
idnoKey ID (UUID).
user_idnoUser ID that owns the key.
api_keynoPlaintext key (returned once).
prefixno12-char key prefix.
key_hashno64-char hex HMAC hash of the full key.
key_addressno16-char hex key address from the token service (currently xxhash64(user_id) for JWT issuance).
key_suffixnoLast 4 chars of the plaintext key (for display).
 
{"signatures":{"go":"func (x *ApiKeysClient) CreateApiKey(ctx context.Context, req *api_keysv1.CreateApiKeyRequest) (*api_keysv1.CreateApiKeyResponse, error)","python":"create_api_key(req: api_keys_pb2.CreateApiKeyRequest) -\u003e CreateApiKeyResponse","typescript":"createApiKey(req: MessageInitShape\u003c typeof tars_api_keys_v1_api_keys_pb.CreateApiKeyRequestSchema \u003e): Promise\u003cCreateApiKeyResponse\u003e","cli":"tare api api-keys create","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/api-keys\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": \"...\",\n    \"user_key_address\": \"...\",\n    \"name\": \"...\",\n    \"enterprise_context\": {}\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tapi_keysv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/api_keys/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026api_keysv1.CreateApiKeyRequest{}\n\n\tresp, err := client.ApiKeys().CreateApiKey(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/apikeys/createapikey\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.api_keys.v1 import api_keys_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = api_keys_pb2.CreateApiKeyRequest()\ntry:\n    result = client.api_keys.create_api_key(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.apiKeys.createApiKey(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"apikeys\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api api-keys create","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/api-keys\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": \"...\",\n    \"user_key_address\": \"...\",\n    \"name\": \"...\",\n    \"enterprise_context\": {}\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/v1/api-keys","slug":"create-api-key"}

Update api key

What it does: Updates mutable fields of an API key (name and/or active state).

Request fields:

FieldRequiredDescription
user_idnoUser ID that owns the API key.
key_idnoKey ID (UUID).
namenoOptional new name.
is_activenoOptional active state.

Response fields:

FieldRequiredDescription
successnoTrue when the update was applied; failures surface as RPC errors instead.
 
{"signatures":{"go":"func (x *ApiKeysClient) UpdateApiKey(ctx context.Context, req *api_keysv1.UpdateApiKeyRequest) (*api_keysv1.UpdateApiKeyResponse, error)","python":"update_api_key(req: api_keys_pb2.UpdateApiKeyRequest) -\u003e UpdateApiKeyResponse","typescript":"updateApiKey(req: MessageInitShape\u003c typeof tars_api_keys_v1_api_keys_pb.UpdateApiKeyRequestSchema \u003e): Promise\u003cUpdateApiKeyResponse\u003e","cli":"tare api api-keys update","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/api-keys/key_01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": \"...\",\n    \"name\": \"...\",\n    \"is_active\": false\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tapi_keysv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/api_keys/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026api_keysv1.UpdateApiKeyRequest{}\n\n\tresp, err := client.ApiKeys().UpdateApiKey(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/apikeys/updateapikey\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.api_keys.v1 import api_keys_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = api_keys_pb2.UpdateApiKeyRequest()\ntry:\n    result = client.api_keys.update_api_key(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.apiKeys.updateApiKey(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"apikeys\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api api-keys update","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/api-keys/key_01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": \"...\",\n    \"name\": \"...\",\n    \"is_active\": false\n  }'"},"persona":"Admin","httpVerb":"PATCH","httpPath":"/v1/api-keys/{key_id}","slug":"update-api-key"}

Delete api key

What it does: Soft-deletes an API key (sets deleted_at).

Request fields:

FieldRequiredDescription
user_idnoUser ID that owns the API key.
key_idnoKey ID (UUID).

Response fields:

FieldRequiredDescription
successnoTrue when the key was soft-deleted; failures surface as RPC errors instead.
 
{"signatures":{"go":"func (x *ApiKeysClient) DeleteApiKey(ctx context.Context, req *api_keysv1.DeleteApiKeyRequest) (*api_keysv1.DeleteApiKeyResponse, error)","python":"delete_api_key(req: api_keys_pb2.DeleteApiKeyRequest) -\u003e DeleteApiKeyResponse","typescript":"deleteApiKey(req: MessageInitShape\u003c typeof tars_api_keys_v1_api_keys_pb.DeleteApiKeyRequestSchema \u003e): Promise\u003cDeleteApiKeyResponse\u003e","cli":"tare api api-keys delete","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/api-keys/key_01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tapi_keysv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/api_keys/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026api_keysv1.DeleteApiKeyRequest{}\n\n\tresp, err := client.ApiKeys().DeleteApiKey(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/apikeys/deleteapikey\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.api_keys.v1 import api_keys_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = api_keys_pb2.DeleteApiKeyRequest()\ntry:\n    result = client.api_keys.delete_api_key(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.apiKeys.deleteApiKey(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"apikeys\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api api-keys delete","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/api-keys/key_01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"DELETE","httpPath":"/v1/api-keys/{key_id}","slug":"delete-api-key"}