Codebase API Keys API
The API Keys API from Codebase — 3 operation(s) for api keys.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/codebase-design:codebase-design-api-keys-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Codebase Design API Keys API
version: 1.0.0
contact:
email: admin@aipowergrid.io
description: 'Operations tagged API Keys across 2 of this provider''s published API definitions: codebase-design-openapi.json, codebase-design-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: http://localhost:3001
description: Current
- url: https://dev.codebase.design
description: Development
- url: https://staging.codebase.design
description: Staging
- url: https://codebase.design
description: Production
security:
- ApiKeyAuth: []
- BearerAuth: []
tags:
- name: API Keys
paths:
/api/v1/api-keys:
post:
summary: Create an API key
description: Generate a new scoped API key. The raw key is returned ONCE — store it securely.
tags:
- API Keys
security:
- BearerAuth: []
- ApiKeyAuth: []
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- name
- scopes
properties:
name:
type: string
description: Human label for this key
scopes:
type: array
items:
type: string
enum:
- inference
- projects:read
- projects:write
- builds:read
- builds:write
- deploys:read
- deploys:write
- gallery:read
- gallery:write
- billing:read
- billing:write
- chat:read
- chat:write
- chat:admin
- admin:*
environment:
type: string
enum:
- live
- test
default: live
expiresInDays:
type: integer
description: Days until expiry (omit for no expiry)
budgetCredits:
type: integer
nullable: true
description: 'Lifetime credit limit for builds started, and inference calls made, with this key (omit or null for no limit). An inference call is checked before it runs and debited after, so it can overshoot the limit by at most its own cost. Builds running at once share it: a build is refused with 402 key-budget-exhausted when what is left, less the estimated spend of builds still running on the key, cannot fit the smallest build (10 credits), and a running build is stopped once its estimate passes its share. The real cost is always charged, so spend can end above the limit by at most the final delta of one build (its last live estimate vs its final debit, for each build running when the line is reached); creditsRemaining then reads 0 and the next build is refused.'
responses:
'201':
description: Key created — raw key returned once
content:
application/json:
schema:
type: object
properties:
key:
type: string
description: Raw API key (shown once)
prefix:
type: string
name:
type: string
scopes:
type: array
items:
type: string
expiresAt:
type: integer
nullable: true
budgetCredits:
type: integer
nullable: true
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: Forbidden — API key auth requires admin:* scope
'500':
description: Internal server error
x-codeSamples:
- lang: TypeScript
label: TypeScript
source: "// Auth: Bearer JWT.\nconst token = process.env.CODEBASE_API_KEY!;\n\nconst res = await fetch('https://codebase.design/api/v1/api-keys', {\n method: 'POST',\n headers: {\n 'Authorization': `Bearer ${token}`,\n 'Content-Type': 'application/json',\n },\n body: JSON.stringify({\n \"name\": \"string\",\n \"scopes\": [\n \"inference\"\n ],\n \"environment\": \"live\",\n \"expiresInDays\": 0,\n \"budgetCredits\": 0\n })\n});\n\nif (!res.ok) throw new Error(`${res.status} ${await res.text()}`);\nconst data = await res.json();\nconsole.log(data);"
- lang: Python
label: Python
source: "import os\nimport requests\n\ntoken = os.environ['CODEBASE_API_KEY']\n\nresponse = requests.post(\n 'https://codebase.design/api/v1/api-keys',\n headers={\n 'Authorization': f'Bearer {token}',\n 'Content-Type': 'application/json',\n },\n json={\n \"name\": \"string\",\n \"scopes\": [\n \"inference\"\n ],\n \"environment\": \"live\",\n \"expiresInDays\": 0,\n \"budgetCredits\": 0\n }\n)\nresponse.raise_for_status()\nprint(response.json())"
- lang: Rust
label: Rust
source: "// Cargo.toml:\n// reqwest = { version = \"0.12\", features = [\"json\"] }\n// serde_json = \"1\"\n// tokio = { version = \"1\", features = [\"full\"] }\n\nuse std::env;\n\n#[tokio::main]\nasync fn main() -> Result<(), Box<dyn std::error::Error>> {\n let token = env::var(\"CODEBASE_API_KEY\")?;\n let client = reqwest::Client::new();\n\n let res = client\n .post(\"https://codebase.design/api/v1/api-keys\")\n .bearer_auth(token)\n .header(\"Content-Type\", \"application/json\")\n .json(&serde_json::json!({\n \"name\": \"string\",\n \"scopes\": [\n \"inference\"\n ],\n \"environment\": \"live\",\n \"expiresInDays\": 0,\n \"budgetCredits\": 0\n }))\n .send()\n .await?;\n\n let data: serde_json::Value = res.json().await?;\n println!(\"{:#?}\", data);\n Ok(())\n}"
operationId: postApiV1ApiKeys
x-operation-id-source: derived
get:
summary: List your API keys
description: Returns all keys for the authenticated user (prefix only, never the raw key).
tags:
- API Keys
security:
- BearerAuth: []
- ApiKeyAuth: []
responses:
'200':
description: Key list
content:
application/json:
schema:
type: object
properties:
keys:
type: array
items:
type: object
properties:
prefix:
type: string
name:
type: string
scopes:
type: array
items:
type: string
environment:
type: string
lastUsedAt:
type: integer
nullable: true
expiresAt:
type: integer
nullable: true
createdAt:
type: integer
budgetCredits:
type: integer
nullable: true
description: Owner-set lifetime credit limit; null = no limit. Spend can end above it by at most the final delta of one build, since the real cost is always charged
creditsSpent:
type: integer
description: Credits debited for builds this key started
creditsRemaining:
type: integer
nullable: true
description: budgetCredits minus creditsSpent, floored at 0; null = no limit
buildCount:
type: integer
description: Builds started with this key
lastBuildAt:
type: integer
nullable: true
connectedApp:
type: boolean
description: Present and true for an app connected over OAuth (MCP connector); it can be limited and revoked but not rotated
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: Forbidden — API key auth requires admin:* scope
'500':
description: Internal server error
x-codeSamples:
- lang: TypeScript
label: TypeScript
source: "// Auth: Bearer JWT.\nconst token = process.env.CODEBASE_API_KEY!;\n\nconst res = await fetch('https://codebase.design/api/v1/api-keys', {\n method: 'GET',\n headers: {\n 'Authorization': `Bearer ${token}`,\n 'Content-Type': 'application/json',\n }\n});\n\nif (!res.ok) throw new Error(`${res.status} ${await res.text()}`);\nconst data = await res.json();\nconsole.log(data);"
- lang: Python
label: Python
source: "import os\nimport requests\n\ntoken = os.environ['CODEBASE_API_KEY']\n\nresponse = requests.get(\n 'https://codebase.design/api/v1/api-keys',\n headers={\n 'Authorization': f'Bearer {token}',\n 'Content-Type': 'application/json',\n }\n)\nresponse.raise_for_status()\nprint(response.json())"
- lang: Rust
label: Rust
source: "// Cargo.toml:\n// reqwest = { version = \"0.12\", features = [\"json\"] }\n// serde_json = \"1\"\n// tokio = { version = \"1\", features = [\"full\"] }\n\nuse std::env;\n\n#[tokio::main]\nasync fn main() -> Result<(), Box<dyn std::error::Error>> {\n let token = env::var(\"CODEBASE_API_KEY\")?;\n let client = reqwest::Client::new();\n\n let res = client\n .get(\"https://codebase.design/api/v1/api-keys\")\n .bearer_auth(token)\n .header(\"Content-Type\", \"application/json\")\n .send()\n .await?;\n\n let data: serde_json::Value = res.json().await?;\n println!(\"{:#?}\", data);\n Ok(())\n}"
operationId: getApiV1ApiKeys
x-operation-id-source: derived
servers:
- url: http://localhost:3001
description: Current
- url: http://localhost:3001
description: Local development
- url: https://dev.codebase.design
description: Development
- url: https://staging.codebase.design
description: Staging
- url: https://codebase.design
description: Production
/api/v1/api-keys/{prefix}:
patch:
summary: Set an API key's spending limit
description: Set, change, or clear (null) the lifetime credit limit for builds started with this key. A key cannot change its own limit.
tags:
- API Keys
security:
- BearerAuth: []
- ApiKeyAuth: []
parameters:
- in: path
name: prefix
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- budgetCredits
properties:
budgetCredits:
type: integer
nullable: true
responses:
'200':
description: Limit updated
content:
application/json:
schema:
type: object
properties:
prefix:
type: string
budgetCredits:
type: integer
nullable: true
creditsSpent:
type: integer
creditsRemaining:
type: integer
nullable: true
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: Forbidden — admin:* scope required, or the key tried to change its own limit
'404':
$ref: '#/components/responses/NotFound'
'500':
description: Internal server error
x-codeSamples:
- lang: TypeScript
label: TypeScript
source: "// Auth: Bearer JWT.\nconst token = process.env.CODEBASE_API_KEY!;\n\nconst res = await fetch('https://codebase.design/api/v1/api-keys/YOUR_PREFIX', {\n method: 'PATCH',\n headers: {\n 'Authorization': `Bearer ${token}`,\n 'Content-Type': 'application/json',\n },\n body: JSON.stringify({\n \"budgetCredits\": 0\n })\n});\n\nif (!res.ok) throw new Error(`${res.status} ${await res.text()}`);\nconst data = await res.json();\nconsole.log(data);"
- lang: Python
label: Python
source: "import os\nimport requests\n\ntoken = os.environ['CODEBASE_API_KEY']\n\nresponse = requests.patch(\n 'https://codebase.design/api/v1/api-keys/YOUR_PREFIX',\n headers={\n 'Authorization': f'Bearer {token}',\n 'Content-Type': 'application/json',\n },\n json={\n \"budgetCredits\": 0\n }\n)\nresponse.raise_for_status()\nprint(response.json())"
- lang: Rust
label: Rust
source: "// Cargo.toml:\n// reqwest = { version = \"0.12\", features = [\"json\"] }\n// serde_json = \"1\"\n// tokio = { version = \"1\", features = [\"full\"] }\n\nuse std::env;\n\n#[tokio::main]\nasync fn main() -> Result<(), Box<dyn std::error::Error>> {\n let token = env::var(\"CODEBASE_API_KEY\")?;\n let client = reqwest::Client::new();\n\n let res = client\n .patch(\"https://codebase.design/api/v1/api-keys/YOUR_PREFIX\")\n .bearer_auth(token)\n .header(\"Content-Type\", \"application/json\")\n .json(&serde_json::json!({\n \"budgetCredits\": 0\n }))\n .send()\n .await?;\n\n let data: serde_json::Value = res.json().await?;\n println!(\"{:#?}\", data);\n Ok(())\n}"
operationId: patchApiV1ApiKeysByPrefix
x-operation-id-source: derived
delete:
summary: Revoke an API key
tags:
- API Keys
security:
- BearerAuth: []
- ApiKeyAuth: []
parameters:
- in: path
name: prefix
required: true
schema:
type: string
description: Key prefix (first 8 chars shown in list)
responses:
'200':
description: Key revoked
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
prefix:
type: string
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: Forbidden — API key auth requires admin:* scope
'404':
$ref: '#/components/responses/NotFound'
'500':
description: Internal server error
x-codeSamples:
- lang: TypeScript
label: TypeScript
source: "// Auth: Bearer JWT.\nconst token = process.env.CODEBASE_API_KEY!;\n\nconst res = await fetch('https://codebase.design/api/v1/api-keys/YOUR_PREFIX', {\n method: 'DELETE',\n headers: {\n 'Authorization': `Bearer ${token}`,\n 'Content-Type': 'application/json',\n }\n});\n\nif (!res.ok) throw new Error(`${res.status} ${await res.text()}`);\nconst data = await res.json();\nconsole.log(data);"
- lang: Python
label: Python
source: "import os\nimport requests\n\ntoken = os.environ['CODEBASE_API_KEY']\n\nresponse = requests.delete(\n 'https://codebase.design/api/v1/api-keys/YOUR_PREFIX',\n headers={\n 'Authorization': f'Bearer {token}',\n 'Content-Type': 'application/json',\n }\n)\nresponse.raise_for_status()\nprint(response.json())"
- lang: Rust
label: Rust
source: "// Cargo.toml:\n// reqwest = { version = \"0.12\", features = [\"json\"] }\n// serde_json = \"1\"\n// tokio = { version = \"1\", features = [\"full\"] }\n\nuse std::env;\n\n#[tokio::main]\nasync fn main() -> Result<(), Box<dyn std::error::Error>> {\n let token = env::var(\"CODEBASE_API_KEY\")?;\n let client = reqwest::Client::new();\n\n let res = client\n .delete(\"https://codebase.design/api/v1/api-keys/YOUR_PREFIX\")\n .bearer_auth(token)\n .header(\"Content-Type\", \"application/json\")\n .send()\n .await?;\n\n let data: serde_json::Value = res.json().await?;\n println!(\"{:#?}\", data);\n Ok(())\n}"
operationId: deleteApiV1ApiKeysByPrefix
x-operation-id-source: derived
servers:
- url: http://localhost:3001
description: Current
- url: http://localhost:3001
description: Local development
- url: https://dev.codebase.design
description: Development
- url: https://staging.codebase.design
description: Staging
- url: https://codebase.design
description: Production
/api/v1/api-keys/{prefix}/rotate:
post:
summary: Rotate an API key
description: Atomically creates a new key with the same scopes and revokes the old one. Returns the new raw key (shown once).
tags:
- API Keys
security:
- BearerAuth: []
- ApiKeyAuth: []
parameters:
- in: path
name: prefix
required: true
schema:
type: string
responses:
'200':
description: Key rotated — new key returned once
content:
application/json:
schema:
type: object
properties:
newKey:
type: string
newPrefix:
type: string
revokedPrefix:
type: string
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: Forbidden — API key auth requires admin:* scope
'404':
$ref: '#/components/responses/NotFound'
'500':
description: Internal server error
x-codeSamples:
- lang: TypeScript
label: TypeScript
source: "// Auth: Bearer JWT.\nconst token = process.env.CODEBASE_API_KEY!;\n\nconst res = await fetch('https://codebase.design/api/v1/api-keys/YOUR_PREFIX/rotate', {\n method: 'POST',\n headers: {\n 'Authorization': `Bearer ${token}`,\n 'Content-Type': 'application/json',\n }\n});\n\nif (!res.ok) throw new Error(`${res.status} ${await res.text()}`);\nconst data = await res.json();\nconsole.log(data);"
- lang: Python
label: Python
source: "import os\nimport requests\n\ntoken = os.environ['CODEBASE_API_KEY']\n\nresponse = requests.post(\n 'https://codebase.design/api/v1/api-keys/YOUR_PREFIX/rotate',\n headers={\n 'Authorization': f'Bearer {token}',\n 'Content-Type': 'application/json',\n }\n)\nresponse.raise_for_status()\nprint(response.json())"
- lang: Rust
label: Rust
source: "// Cargo.toml:\n// reqwest = { version = \"0.12\", features = [\"json\"] }\n// serde_json = \"1\"\n// tokio = { version = \"1\", features = [\"full\"] }\n\nuse std::env;\n\n#[tokio::main]\nasync fn main() -> Result<(), Box<dyn std::error::Error>> {\n let token = env::var(\"CODEBASE_API_KEY\")?;\n let client = reqwest::Client::new();\n\n let res = client\n .post(\"https://codebase.design/api/v1/api-keys/YOUR_PREFIX/rotate\")\n .bearer_auth(token)\n .header(\"Content-Type\", \"application/json\")\n .send()\n .await?;\n\n let data: serde_json::Value = res.json().await?;\n println!(\"{:#?}\", data);\n Ok(())\n}"
operationId: postApiV1ApiKeysByPrefixRotate
x-operation-id-source: derived
servers:
- url: http://localhost:3001
description: Current
- url: http://localhost:3001
description: Local development
- url: https://dev.codebase.design
description: Development
- url: https://staging.codebase.design
description: Staging
- url: https://codebase.design
description: Production
components:
responses:
BadRequest:
description: Invalid request parameters
content:
application/json:
schema:
type: object
properties:
error:
type: string
NotFound:
description: Resource not found
content:
application/json:
schema:
type: object
properties:
error:
type: string
Unauthorized:
description: Missing or invalid authentication
content:
application/json:
schema:
type: object
properties:
error:
type: string
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
description: Revocable API key (cb_live_... or cb_test_...)
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth2 access token
x-refined-from:
- codebase-design-openapi.json
- codebase-design-openapi.yml