createUserApiKey
Creates a new API key for the authenticated user. This key can be used to authenticate API requests from external applications like the Raycast extension.Parameters
Optional friendly name for the API key (for display purposes)
Returns
Unique identifier for the API key record
The friendly name of the API key
The 12-character prefix used for identification (e.g.,
a1b2c3d4e5f6)The complete API key in format:
teakapi_[prefix]_[secret]Access level granted to this key (currently always
full_access)Unix timestamp (in milliseconds) when the key was created
Usage
Generate Key in Settings
Example Response
Security
Key Format
API keys follow this structure:- Prefix: 12-character hex string (6 random bytes)
- Secret: 48-character hex string (24 random bytes)
- Total length: 67 characters
Hashing
Keys are hashed with SHA-256 and a server-side pepper before storage:Storage Recommendations
Environment Variables
Environment Variables
Store API keys in environment variables, never in code:
Secret Managers
Secret Managers
Use secret management services in production:
- AWS Secrets Manager
- HashiCorp Vault
- 1Password CLI
- Doppler
Never Commit Keys
Never Commit Keys
Add to
.gitignore:Behavior
Automatic Revocation
When you create a new API key:- All existing active keys for your user are revoked
- The new key is created and returned
- Old keys become invalid immediately
Default Name
If no name is provided, the key is named"API Keys" by default.
Access Levels
Currently, all API keys havefull_access, which grants:
- Full read access to your cards
- Full write access (create, update, delete cards)
- File upload permissions
- Search capabilities
More granular permission levels may be added in future releases.
Error Handling
Authentication Required
Related APIs
List API Keys
View your active and revoked API keys
Revoke API Key
Revoke an existing API key
Authentication
Learn how to use API keys