Authentication

Every request to the REST API is authenticated with an API key passed as a Bearer token.

Creating an API Key

Go to Account → API Keys in the console
Click Create API Key
Give it a descriptive name (e.g. "Deploy pipeline — production")
Copy the key immediately — it is shown only once and stored hashed

Keys start with ek_live_ and can be created with an optional expiry (30 days, 90 days, 1 year, or never). Keys can be revoked at any time; revocation takes effect immediately.

Keys are account-wide

An API key carries full access to the account that created it — treat it like a password. Never commit keys to version control, and prefer one key per integration so individual keys can be revoked without breaking everything else.

Making Authenticated Requests

Pass the key in the Authorization header:

curl https://edge.network/api/compute/vms \
  -H "Authorization: Bearer ek_live_abc123def456..."

A missing, malformed, revoked, or expired key returns 401:

HTTP/1.1 401 Unauthorized

{
  "error": "Invalid or expired API key",
  "code": "AUTHENTICATION_ERROR"
}

Managing Keys via the API

API keys can themselves be managed programmatically (using an existing key or console session):

Endpoint	Description
GET /api/account/keys	List keys — returns name, prefix, last-used, and expiry (never the secret)
POST /api/account/keys	Create — `{ name, expiresIn? }` where `expiresIn` is e.g. `30d`, `90d`, `1y`, or `never`. The full secret is returned once.
PATCH /api/account/keys/:keyId	Rename a key
DELETE /api/account/keys/:keyId	Revoke a key immediately

Need Narrower Access?

API keys are all-or-nothing. If you're granting access to an AI agent or third-party tool and want per-product permissions and spending caps, use an Agent Access Code (ea_live_...) with the Agent API instead.

Credential	Prefix	Scope	Used with
API key	ek_live_	Full account access	REST API (`/api/*`), CLI
Agent access code	ea_live_	Per-product permissions, budget caps	Agent API (`/agent/*`)