Lexicon Garden

dev.cocore.account.createApiKey

Mint a new cocore API key for the authenticated account. Authenticate with either a console session cookie or an existing `Authorization: Bearer cocore-...` key. The full secret is returned exactly once in `secret` and is never retrievable again — only its SHA-256 hash is stored. Use the returned key to authenticate subsequent automated requests (inference, the record proxy, and these key-management methods themselves).

Repository @cocore.dev did:plc:5quuhkmwe2q4k3azfsgg7kdz namespace authority
Details · procedure
Kindprocedure
Authorityaccount.cocore.dev
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

expiresAt

string · datetime

Optional RFC3339 expiry. Omit (or send null) for a key that never expires on its own.

name

requiredstring

Human-readable label so the owner can tell their keys apart.

  • minLength: 1
  • maxLength: 100

Output

application/json

secret

requiredstring

The full plaintext key (`cocore-<43 url-safe base64 chars>`). Shown exactly once; store it now.

Errors

AuthRequired

No valid session cookie or bearer key was presented.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • social.coves.aggregator.createApiKey

    procedure

    Create an API key for the authenticated aggregator. Requires OAuth authentication. The API key is returned ONCE and cannot be retrieved again. Store it securely.

  • dev.cocore.account.listApiKeys

    query

    List every API key belonging to the authenticated account, most-recently-created first. The owning DID is derived from the credential presented (session cookie or `Authorization: Bearer cocore-...`); there is no way to list another account's keys. Secrets are never returned — see `apiKeyView`.

  • dev.cocore.account.defs

    Shared type definitions for dev.cocore.account.* methods.

  • dev.cocore.account.deleteApiKey

    procedure

    Hard-delete one of the authenticated account's API keys, removing the row entirely (no audit trail recovery afterwards). For most flows revokeApiKey is preferable; use this to clean up revoked or expired keys you no longer want listed. Scoped to the caller's DID. Idempotent: deleting an unknown key returns `deleted: false`.

  • dev.cocore.account.revokeApiKey

    procedure

    Revoke one of the authenticated account's API keys. The key stops authenticating immediately, but the row is retained with `revokedAt` set so it stays visible in listApiKeys as a revoked key (audit trail). Use deleteApiKey to remove it entirely. Scoped to the caller's DID — you cannot revoke another account's key. Idempotent: revoking an already-revoked or unknown key returns `revoked: false`.