API Keys
Keys are created and revoked by a person in a browser, never by a program. This resource is documented so the boundary is visible, not so it can be automated.
GET/api/keys
List your keys. Prefixes only — the secret is never returned again.
Session cookie only. An API key is refused regardless of scope — A key cannot mint or manage a key, so a leaked one cannot bootstrap a stronger one.
Errors
| Status | When |
|---|---|
401 | Not signed in, or a key was presented instead of a session. |
POST/api/keys
Create a key. The plaintext secret is returned exactly once.
Session cookie only. An API key is refused regardless of scope — A key cannot mint or manage a key, so a leaked one cannot bootstrap a stronger one.
Errors
| Status | When |
|---|---|
401 | Not signed in, or a key was presented instead of a session. |
The secret begins `tsn_cloud_` and is shown once. Tessen stores a hash; there is no endpoint that can return it again, and nobody at Tessen can read it.
DELETE/api/keys
Revoke a key.
Session cookie only. An API key is refused regardless of scope — A key cannot mint or manage a key, so a leaked one cannot bootstrap a stronger one.
Errors
| Status | When |
|---|---|
401 | Not signed in, or a key was presented instead of a session. |
Revoking a key that is not yours answers the same way as revoking one that does not exist — probing reveals nothing.