API keys
Issuing and revoking orchestrator-global API keys
client.apiKeys mints and revokes API keys. All three methods require the
master token, the server enforces this regardless of what token the client
was constructed with. They are also Postgres-only: with DATABASE_URL
unset the orchestrator never mounts the /v1/api-keys routes at all, and all
three methods throw a FuseApiError with status === 404 and
code === "route_not_found", which isNotFound() does not match. The master
token still works either way.
const key = await client.apiKeys.create("ci-runner");
console.log("save this now:", key.key); // shown exactly oncelabel is optional. key.key holds the raw secret and is returned exactly
once, it cannot be recovered afterward, store it immediately.
Everything else
| Method | Purpose |
|---|---|
list() |
List key metadata, APIKey has no key field. last_used_at/revoked_at are absent until they happen. |
revoke(id) |
Revoke the key with the given id (the APIKey.id, not the secret itself). |
These mirror the HTTP API one to one.