> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.6mm.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.6mm.com/_mcp/server.

# API Key Management

> Create, inspect, update, and revoke 6MM API keys while applying appropriate permissions, IP restrictions, secret storage, and rotation practices.

API Key management endpoints only accept JWT authentication.

## Create API Key

```http
POST /v1/private/user/api-key/create
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
```

Request parameters:

| Parameter     | Type      | Required | Description                                                           |
| ------------- | --------- | -------- | --------------------------------------------------------------------- |
| `label`       | string    | Yes      | API Key label, length 1 - 64                                          |
| `permissions` | int       | No       | Permission bitmask, default `1`, range `1` - `7`                      |
| `ipWhitelist` | string\[] | No       | IP whitelist, up to 20 entries. If omitted, source IP is unrestricted |

Request example:

```bash
curl -X POST https://api.6mm.com/v1/private/user/api-key/create \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "label": "external-service-prod",
    "permissions": 3,
    "ipWhitelist": ["203.0.113.10"]
  }'
```

Response example:

```json
{
  "code": 0,
  "message": "success",
  "data": {
    "apiKey": "fx_xxxxxxxxxxxxxxxxxxxxxxxx",
    "apiSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "requestId": "req-api-key"
}
```

`apiSecret` is returned only once when the API Key is created. Store it immediately in a secret management system. Do not write it into source code repositories or logs.

Each user can create up to 30 API Keys.

## List API Keys

```http
GET /v1/private/user/api-key/list
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Response fields:

| Field                | Type      | Description                       |
| -------------------- | --------- | --------------------------------- |
| `list[].id`          | string    | API Key ID                        |
| `list[].label`       | string    | Label                             |
| `list[].apiKey`      | string    | Public API Key identifier         |
| `list[].permissions` | int       | Permission bitmask                |
| `list[].ipWhitelist` | string\[] | IP whitelist                      |
| `list[].status`      | int       | Status: `1` enabled, `0` disabled |
| `list[].lastUsedAt`  | int64     | Last used time                    |
| `list[].createdAt`   | int64     | Creation time                     |

## Update API Key

```http
PUT /v1/private/user/api-key/update
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
```

Request parameters:

| Parameter     | Type      | Required | Description               |
| ------------- | --------- | -------- | ------------------------- |
| `id`          | string    | Yes      | API Key ID                |
| `label`       | string    | No       | New label                 |
| `permissions` | int       | No       | New permission bitmask    |
| `ipWhitelist` | string\[] | No       | New IP whitelist          |
| `status`      | int       | No       | `1` enabled, `0` disabled |

## Delete API Key

```http
POST /v1/private/user/api-key/delete
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
```

Request body:

```json
{ "id": "1001" }
```

## Delete All API Keys

```http
POST /v1/private/user/api-key/delete-all
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
```

Response fields:

| Field     | Type  | Description                |
| --------- | ----- | -------------------------- |
| `deleted` | int64 | Number of deleted API Keys |

## Related security guides

* [Authentication](/developer-api/authentication)
* [Request Signing](/developer-api/request-signing)
* [Secrets & Signing](/sdk/security/secrets-signing)
* [Integration Recommendations](/developer-api/integration-recommendations)