DocsAPIAPI keys

API keys

Create and revoke keys in the API Console. The endpoints behind the Console are listed here too; they take your signed-in session, not an API key.

01In the Console

Keys live on the API keys page of the Console, researchanything.ai/console/keys. Any signed-in ResearchAnything account can use it.

Choose New key, enter a name, and choose Create key.
Copy the key, which starts with ra-. It is shown once.
To stop a key working, choose Revoke on its row and confirm.

The list shows each key's name, prefix, status, creation date and when it was last used. Keys have no expiry date; a key works until it is revoked.

NoteThe endpoints below are listed for reference. They serve the Console in your signed-in browser session and don’t accept an API key.

02List keys

GET/api/console/keys

Returns an array of your keys, newest first. Revoked keys are included. The full key is never returned.

Field	Type	Description
id	string	The key's id (a UUID). Use it to revoke the key.
name	string	The name you gave the key.
prefix	string	The key's first 12 characters, for telling keys apart.
status	string	`active` or `revoked`.
created_at	string	ISO 8601 creation timestamp.
last_used_at	string or null	When a call made with the key last finished. `null` if it has never been used.

JSON — example response

[
  {
    "id": "0b6f4c1e-2a7d-4e39-9f15-7c8d3e2a1b04",
    "name": "prod-backend",
    "prefix": "ra-Qm3kX9vZ",
    "status": "active",
    "created_at": "2026-09-10T08:00:00",
    "last_used_at": "2026-09-28T13:55:21"
  },
  {
    "id": "5e2a9d7c-3b1f-4a60-8c4e-1d2f3a4b5c6d",
    "name": "local-dev",
    "prefix": "ra-7hTpL2wQ",
    "status": "revoked",
    "created_at": "2026-09-02T15:14:09",
    "last_used_at": null
  }
]

03Create a key

POST/api/console/keys

Creates a key on your account. The response includes the full key in plaintext, once. It cannot be retrieved again.

Request body

Param	Type	Required	Description
name	string	yes	A label for the key. It must not be blank; a blank name returns `400` with `"Name is required."`.

JSON — response

{
  "key": {
    "id": "0b6f4c1e-2a7d-4e39-9f15-7c8d3e2a1b04",
    "name": "prod-backend",
    "prefix": "ra-Qm3kX9vZ",
    "status": "active",
    "created_at": "2026-09-28T14:30:00",
    "last_used_at": null
  },
  "plaintext": "ra-Qm3kX9vZ…"
}

CautionResearchAnything stores only a SHA-256 hash of the key. If you don't keep plaintext now, the key cannot be recovered: revoke it and create another.

04Revoke a key

DELETE/api/console/keys/{key_id}

Marks the key revoked and returns {"ok": true}. It takes effect on the next call: requests with the key then fail with 403 and key_inactive. A revoked key cannot be reactivated, and it stays in the list. An id that is not one of your keys returns 404 with "API key not found".

05Looking after keys

A key acts as your account: whoever holds it can spend your research runs. Keys have no scopes or per-key limits, so how you handle them is the only protection.

One key per place

Create a separate key for each environment and service. If one leaks, revoking it stops one service, not all of them, and last_used_at tells you which keys are still in use.

Store keys as secrets

Read keys from the environment at runtime and fill the environment from your platform's secrets manager. Keep them out of source control, logs and error reports.

Keep keys off the client

The query endpoints accept calls from any origin, so a key shipped in a web page, mobile app or browser extension works for anyone who extracts it. Call the API from your own backend.

Rotate by overlap

To replace a key, create the new one, deploy it, check in the Console that the old key's last_used_at has stopped moving, then revoke the old one.