API Keys

Public API: listing only

The stable public management contract supports GET /v1/keys. It returns metadata and never returns full secrets. Public create, delete, and rotate operations are not available.

1curl https://qufas-ai.vercel.app/v1/keys \2  -H "Authorization: Bearer $QUFAS_API_KEY"

Returned metadata fields:

Dashboard management

Dashboard → API Keys can create, update, revoke, and delete keys. Dashboard operations are authenticated product workflows and must not be confused with the stable public API-key management surface.

Dashboard policies can include environment, model allowlist, requests-per-minute limit, monthly spend limit, and expiration.

Rotation workflow

1. Create a replacement key in Dashboard → API Keys.
2. Copy the secret once and update the server-side secret in your application.
3. Verify production traffic with the replacement key.
4. Revoke the old key in the dashboard.

There is no public “rotate key” endpoint in the current API.

Security

• Keep full qf_sk_ secrets server-side.
• The full secret is shown only at creation; stored and listed values are prefixes.
• Use least-privilege model allowlists and separate keys per environment.
• Rate-limit responses include Retry-After and X-RateLimit headers.