Create a key
Every key needs a name of at most 128 characters and an explicit expiry decision, plus one or more explicit permissions. RFC 3339 timestamps are normalized to UTC. Replace the example expiry with a future timestamp when running the command.--json, create prints the API’s response as Photon sends it, with
every field in it, including a field the API adds after this CLI release:
--json, the CLI checks the
secret. An empty secret, one longer than 4,096 characters, or one with a
character outside ASCII ! to ~ (a space or a control character, for
example) fails with PROJECT_PROTOCOL_ERROR, and nothing is printed.
Supported permissions are events:read, events:write, platforms:read,
platforms:write, project:read, and project:write. Repeat --permission
for each permission the service needs. No permissions are granted implicitly.
List and create output include permissions and permissionsUpdatedAt.
List keys
api-key list returns live keys only, so revoked keys drop out of later lists.
It is not paginated — the API returns every live key, newest first. With
--json it prints the API’s response, {"apiKeys": [...]}.
Revoke a key
--json, revoke prints the API’s response, {"apiKey": {...}}, with
the key’s revokedAt set.
revoke takes the API key ID only, and api-key list shows the ID of every
live key. A full API key (pho_sk_… followed by _ and its secret) is refused
with ARGUMENT_VALIDATION before the confirmation question and before any
request, because command-line arguments can persist in shell history and are
visible to other local processes. The error’s next steps are the same command
with the key’s ID in place of the full key, then photon project api-key list.
Rotate safely
Rotation is deliberately not one command, because a single atomic swap gives you no window to verify the replacement:1
Create a replacement key
2
Update your consumers
Deploy the new secret everywhere the old one is used.
3
Verify the replacement
Confirm traffic is flowing with the new key before going further.
4
Revoke the old key