API keys & Bearer tokens

Bearer access for scripts and CI — apps, settings, bans, tiers, users, and the rest of the dashboard API.

What they are

Developer API keys look like sdk_live_…. They are full-account credentials: there are no scopes. A valid key authenticates as you on every requireAuth route — the same surfaces as the dashboard.

They do not authenticate client license validation or end-user register / login / upgrade. Those use the public client paths in License control.

Bearer coverage

With a Bearer token you can:

Apps — create, list, get, delete (DELETE /apps/:id), PATCH /apps/:id/settings (version, status, HWID lock, requireLicenseToRegister, responseMessages — custom text appears as sealed validate message, or as plaintext error / validate message; see API reference)
Bans — GET /apps/:id/bans, DELETE /apps/:id/bans/:banId; ban via POST /licenses/:id/ban with scope license | hwid | hwid_and_ip
Licenses — create (optional subscriptionTier, default 0), blind create, delete, extend; POST/PATCH /licenses/:id/tier to set any integer tier ≥ 0; POST /licenses/:id/reset-hwid to clear the device binding (keeps status and expiry)
Users — POST /apps/:id/users (create end-user; optional licenseKey, still respects requireLicenseToRegister); GET /apps/:id/users (username, email, linked license, tier); POST /apps/:id/users/:userId/reset-hwid to clear lastHwid and unbind any linked license
Logs, metrics, account mask/mode/vault, API key CRUD, /auth/me

Dashboard

Create, copy (once), list, and revoke keys under Settings → API keys. Plaintext is shown only at creation; afterward you only see a prefix and metadata (last_used_at, revoked).

HTTP: create, list, revoke

All require an existing session cookie or another API key.

Create — POST /api/v1/account/api-keys

{
  "name": "ci-bot"
}

201 response (plaintext once)

{
  "success": true,
  "key": {
    "id": "<uuid>",
    "name": "ci-bot",
    "apiKey": "sdk_live_…",
    "keyPrefix": "sdk_live_abcd1234…",
    "createdAt": "…"
  },
  "warning": "API key plaintext is shown once. Store it securely; only the hash is retained."
}

List — GET /api/v1/account/api-keys

{ "success": true, "keys": [ /* prefix + metadata only */ ] }

Revoke — POST /api/v1/account/api-keys/:id/revoke

{ "success": true }

Using the Bearer header

Header

Authorization: Bearer sdk_live_<token>
Content-Type: application/json

Create licenses with tier

curl -X POST https://api.sdkey.dev/api/v1/licenses/create \
  -H 'Authorization: Bearer sdk_live_....' \
  -H 'Content-Type: application/json' \
  -d '{"applicationId":"<uuid>","amount":1,"durationSeconds":2592000,"subscriptionTier":1}'

Patch app settings

curl -X PATCH https://api.sdkey.dev/api/v1/apps/<appId>/settings \
  -H 'Authorization: Bearer sdk_live_....' \
  -H 'Content-Type: application/json' \
  -d '{"hwidLockEnabled":true,"requireLicenseToRegister":true,"version":"1.0.1"}'

Delete app

curl -X DELETE https://api.sdkey.dev/api/v1/apps/<appId> \
  -H 'Authorization: Bearer sdk_live_....'

Ban with scope

curl -X POST https://api.sdkey.dev/api/v1/licenses/<licenseId>/ban \
  -H 'Authorization: Bearer sdk_live_....' \
  -H 'Content-Type: application/json' \
  -d '{"scope":"hwid_and_ip"}'

Set subscription tier

curl -X POST https://api.sdkey.dev/api/v1/licenses/<licenseId>/tier \
  -H 'Authorization: Bearer sdk_live_....' \
  -H 'Content-Type: application/json' \
  -d '{"subscriptionTier":2}'

Reset license HWID

curl -X POST https://api.sdkey.dev/api/v1/licenses/<licenseId>/reset-hwid \
  -H 'Authorization: Bearer sdk_live_....'

Create app user

curl -X POST https://api.sdkey.dev/api/v1/apps/<appId>/users \
  -H 'Authorization: Bearer sdk_live_....' \
  -H 'Content-Type: application/json' \
  -d '{"username":"alice","password":"securepass","email":"[email protected]","licenseKey":"XXXX-...."}'

Reset user HWID

curl -X POST https://api.sdkey.dev/api/v1/apps/<appId>/users/<userId>/reset-hwid \
  -H 'Authorization: Bearer sdk_live_....'

List app users

curl 'https://api.sdkey.dev/api/v1/apps/<appId>/users?limit=50' \
  -H 'Authorization: Bearer sdk_live_....'

List apps

curl https://api.sdkey.dev/api/v1/apps/ \
  -H 'Authorization: Bearer sdk_live_....'

Auth resolution

If both a sdkey_session cookie and a Bearer token are present, the cookie wins. Failed Bearer attempts are rate-limited (30 / min / IP).

Security

Server stores SHA-256 of the key only
Copy the plaintext immediately — it cannot be recovered later
Revoke immediately if a key leaks
Prefer short-lived keys per environment (CI vs laptop)