Skip to main content
Backs the Credentials page. Requires a signed-in session; every operation is scoped to your current organization.

​
List credentials

​
GET /api/admin/credentials

Returns every active credential for your organization. Keys themselves are never included — only metadata.

​
Save a key

​
POST /api/admin/credentials

Encrypts and stores a key. If an active key already exists for the same (provider, label), it’s deactivated (not deleted) first — this is a rotation, not an overwrite.

​
Request body

​
string
required
One of harvest, serper, anthropic, prospeo.
​
string
required
The plaintext key. Must be at least 8 characters. Encrypted (AES-256-GCM) before the database write — see API Keys → How this stays secure.
​
string
default:"default"
Lets a single provider have more than one named credential, if that’s ever needed.

​
Response

​
Deactivate a key

​
DELETE /api/admin/credentials/:id

Marks the credential inactive (retired_at set) rather than deleting the row — the audit trail of every key that was ever active is preserved.

​
Errors

All three endpoints return 401 { "error": "Sign in required" } without a session. POST returns 400 with a validation message if provider or apiKey fail validation. Anything else surfaces as 500 with the underlying error message.