API keys
3 API keys routes on the FLAM API: List the house's API keys; Mint an organisation API key; Revoke an API key.
Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.
GET /api/keys
List the house's API keys
Revoked keys are included (with revokedAt set) so the audit trail is visible.
Responses
| Status | Meaning |
|---|---|
200 | Every key this organisation has minted |
401 | Unauthenticated, or authenticated with an API key |
200 returns:
{
"keys": [
{
"id": "string",
"name": "string",
"role": "viewer",
"prefix": "string",
"lastUsedAt": "string",
"revokedAt": "string",
"createdAt": "string"
}
]
}Call it
curl -X GET "https://api.flam.fashion/api/keys" \
-H "Authorization: Bearer $FLAM_API_KEY"POST /api/keys
Mint an organisation API key
Returns the raw key ONCE — it is stored only as a SHA-256 hash and cannot be shown again. Session auth only: an API key may not mint another API key.
Request body — application/json
| Field | Type | Required | Notes |
|---|---|---|---|
name | string | yes | — |
role | "viewer" | "member" | no | — |
{
"name": "string",
"role": "member"
}Responses
| Status | Meaning |
|---|---|
201 | The new key — key is shown only here |
401 | Unauthenticated, or authenticated with an API key |
403 | A viewer seat may not mint a token-spending key |
201 returns:
{
"id": "string",
"name": "string",
"role": "viewer",
"prefix": "string",
"lastUsedAt": "string",
"revokedAt": "string",
"createdAt": "string",
"key": "string"
}Call it
curl -X POST "https://api.flam.fashion/api/keys" \
-H "Authorization: Bearer $FLAM_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"string","role":"member"}'DELETE /api/keys/{id}
Revoke an API key
Takes effect on the next request — the key row is re-read from Postgres on every call, so there is no cache to wait out. The row is kept, not deleted.
Parameters
| In | Name | Type | Required | Notes |
|---|---|---|---|---|
| path | id | string | yes | — |
Responses
| Status | Meaning |
|---|---|
200 | Revoked (idempotent) |
401 | Unauthenticated, or authenticated with an API key |
404 | No such key in this organisation |
200 returns:
{
"revoked": true,
"id": "string"
}Call it
curl -X DELETE "https://api.flam.fashion/api/keys/{id}" \
-H "Authorization: Bearer $FLAM_API_KEY"