API keys

Inference keys (ad_…) authenticate both /v1/* inference and org-scoped /api/* management.

The plaintext key is returned exactly once, at creation. Listings only ever show the prefix (like ad_9WTqoA). Revoked keys fail with 401 on their next use.

POST/api/auth/keys

Mint a key for an org (the org is created on first use by admin keys). Org keys may only create keys for their own org; orgName is ignored for them.

Body field	Description
`orgName`	Org name (admin keys only)
`label`	Optional label for bookkeeping

curl https://lorivo.dev/api/auth/keys \
  -H "Authorization: Bearer ad_…" \
  -H "Content-Type: application/json" \
  -d '{"label":"prod-eu"}'

201 response

{
  "org": { "id": "…", "name": "acme-ai" },
  "prefix": "ad_9WTqoA",
  "key": "ad_9WTqoA1bC2dE3fG4hJ5kL6mN7pQ8rS9"
}

GET/api/auth/keys

List keys. Org keys only ever see their own org; the admin key may filter with ?orgId=…. Never includes the plaintext.

curl https://lorivo.dev/api/auth/keys \
  -H "Authorization: Bearer ad_…"

response

{
  "keys": [
    {
      "id": "…",
      "prefix": "ad_9WTqoA",
      "label": "prod-eu",
      "revokedAt": null,
      "createdAt": "2026-09-01T10:00:00.000Z",
      "org": { "id": "…", "name": "acme-ai" }
    }
  ]
}

POST/api/auth/keys/:id/revoke

Revoke a key (soft delete; sets revokedAt, the row stays visible in listings). No body.

curl -X POST https://lorivo.dev/api/auth/keys/<key-id>/revoke \
  -H "Authorization: Bearer ad_…"

response

{ "ok": true }

DELETE/api/auth/keys/:id

Permanently delete a key.

curl -X DELETE https://lorivo.dev/api/auth/keys/<key-id> \
  -H "Authorization: Bearer ad_…"