API Keys

List, issue, and revoke your API keys without needing Effect team involvement.

Keys are prefixed eff_live_ . The raw key is shown exactly once at issuance and can never be recovered. If you lose your key, revoke it and issue a new one.

List keys

GET /v1/keys

Returns all keys for your account. Raw keys are never returned, only the prefix and hash.

curl

curl -s "https://api.effect.ai/v1/keys" \
  -H "Authorization: Bearer eff_live_YOUR_KEY"

Response 200

{
  "keys": [
    {
      "hash": "a3f8d2c1e4b5a9f0d7c6e3b2a1f8d5c4e9b0a7f6d3c2e1b4a5f8d9c0e3b2a1f",
      "prefix": "eff_live_dGhpcy…",
      "status": "active",
      "createdAt": 1750000000000
    }
  ],
  "total": 1
}

Field	Description
`hash`	SHA-256 hash of the key. Use this to revoke
`prefix`	First 15 characters of the raw key (plus `…`) for identification
`status`	`"active"` or `"revoked"`

Issue a new key

POST /v1/keys

Issues a new API key. The raw key is returned once, so copy it immediately.

Returns 403 forbidden if you already have an active key. Revoke your existing key first.

curl

curl -s -X POST "https://api.effect.ai/v1/keys" \
  -H "Authorization: Bearer eff_live_YOUR_KEY"

Response 201

{
  "key": "eff_live_bmV3a2V5Zm9yZG9jdW1lbnRhdGlvbmV4YW1wbGU",
  "hash": "b4e9c3f2a1d8e5b0c7f4a3e2d1b8c5f4a9e0b7c4f3a2e1d0b5c8f7a4e3d2c1b",
  "prefix": "eff_live_bmV3a2…",
  "status": "active",
  "createdAt": 1750000100000
}

Field	Description
`key`	Raw API key. This is the only time it will be shown
`hash`	SHA-256 hash. Save this if you need to revoke later

Revoke a key

DELETE /v1/keys/:hash

Revokes a key by its SHA-256 hash. This is idempotent, so revoking an already-revoked key returns 200.

Returns 404 if the hash doesn't belong to your account.

curl

curl -s -X DELETE "https://api.effect.ai/v1/keys/KEY_HASH" \
  -H "Authorization: Bearer eff_live_YOUR_KEY"

Response 200

{
  "hash": "a3f8d2c1e4b5a9f0d7c6e3b2a1f8d5c4e9b0a7f6d3c2e1b4a5f8d9c0e3b2a1f",
  "prefix": "eff_live_dGhpcy…",
  "status": "revoked",
  "createdAt": 1750000000000
}

Revoking your last active key

Revoking the only active key requires an explicit confirmation query parameter to prevent accidental lockout:

curl

curl -s -X DELETE "https://api.effect.ai/v1/keys/KEY_HASH?confirm=DELETE" \
  -H "Authorization: Bearer eff_live_YOUR_KEY"

Without ?confirm=DELETE, the request returns 400 invalid_request with a message explaining that this is your last active key. The confirmation is also accepted in the request body as {"confirm": "DELETE"}.