---
title: API keys
description: List, create and revoke Schedule & Chill API keys over the REST API. One key authenticates both the REST API and the MCP server.
published: 2026-06-07
updated: 2026-09-14
---

# API keys
Manage your API keys over the API. Keys authenticate both the REST API and the MCP server — see [Authentication](/help/developers/authentication).

## List keys

```
GET /api/api-keys
```

Returns your keys with a masked preview (the secret is never returned again after creation):

```json
[
    {
        "id": "1234567890abcdef",
        "name": "Production Server",
        "key_preview": "••••••••abcdef",
        "last_used_at": "2026-06-06T12:30:00Z",
        "created_at": "2026-06-05T10:00:00Z"
    }
]
```

---

## Create a key

```
POST /api/api-keys
```

| Field  | Type   | Required | Notes                                            |
| ------ | ------ | -------- | ------------------------------------------------ |
| `name` | string | yes      | A label to identify the key. Max 255 characters. |

```bash
curl -X POST https://schedulenchill.com/api/api-keys \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{ "name": "CI pipeline" }'
```

Returns `201 Created`. The full `token` is included **only in this response** — store it securely, it cannot be retrieved again:

```json
{
    "id": "abc123",
    "name": "CI pipeline",
    "token": "abc123|long-secret-string-shown-once",
    "created_at": "2026-06-06T17:40:00Z"
}
```

---

## Revoke a key

```
DELETE /api/api-keys/{id}
```

Immediately invalidates the key. Returns `204 No Content`. Any request using a revoked key returns `401`.