cs keys

cs keys manages your member API keys. A key acts as the member who created it — same connections, same role — and is what belongs in a configuration file that outlives a session. How member and agent keys differ is on Authentication.

Usage

cs keys create <name>   # mints an sk-cs- key; the secret is shown once
cs keys list
cs keys rotate <id>     # new secret under a new id; name, cap, and usage carry over
cs keys revoke <id>

create

cs keys create mints a key named <name> and prints the secret once. Save it now; it cannot be shown again.

API key created (shown once — save it now):

  sk-cs-…

  id: 3f9c1e0a-7b2d-4c58-9e11-0d6f2a8b4c73

The CLI creates keys without a spend cap or expiry. Set either in Dashboard → API keys.

list

cs keys list prints the API response as JSON: a data array of keys with id, name, the last four characters, spend cap, lifetime and current-month usage, expiry, and timestamps — never the secret.

cs keys list | jq '.data[] | {id, name, last_4}'

rotate

cs keys rotate <id> revokes the key and mints a replacement under a new id, carrying over the name, spend cap, usage, and expiry. The old secret stops working immediately; the new secret and id are printed once as JSON, so update anything that references the old id.

revoke

cs keys revoke <id> invalidates the key. Requests that still carry it answer 401 invalid_api_key.