Programmatic API Key management
Query, create, update, and delete API Keys using an access token.
Follow this guide to automate API Key management in your application. For model calls or SDK setup only, see API Key and authentication.
Get an access token
Create an access token in the “Security” section of your profile to manage that user's API Keys.
Access tokens and model API Keys serve different purposes: management APIs use an access token; model APIs use an API Key. Do not mix them.
Make your first management request
Replace your-user-token with the access token and query the API Key list:
curl 'https://api.agtcloud.cn/api/token/?p=1&size=20' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer your-user-token'On success, locate the target Key in data.items and save its id for detail retrieval, updates, or deletion. With no records, items is an empty array.
The key in list/detail responses may be masked and cannot be used for model calls. Find the complete secret on the API Keys page.
Choose a management operation
Open the relevant Reference for parameters, response examples, or online debugging.
| Operation | Purpose |
|---|---|
| List API Keys | Browse API Keys by page |
| Search API Keys | Find by name or Key value |
| Retrieve API Key | Read configuration by ID |
| Create API Key | Set name, quota, expiry, and access restrictions |
| Update API Key | Change configuration, or enable/disable only |
| Delete API Key | Delete one Key |
| Batch delete API Keys | Delete multiple Keys |
To check a Key's remaining quota, use Query API Key quota and authenticate with that Key, not an access token.
Operation precautions
Verify targets before updating or deleting
An ordinary update may reset omitted fields. Read the details first, then submit all configuration you want to retain. To enable or disable only, use the update endpoint's status-only mode.
Deletion affects applications using the Key. Verify the target ID; do not run deletion with example IDs.
- Check the business result: HTTP
200may still contain a business failure. Checksuccessandmessagetoo. - Avoid duplicate writes: after a create, update, or delete timeout, query first to determine whether it took effect; do not immediately resubmit.
- Protect access tokens: store them in a controlled server environment, not frontend code, public logs, screenshots, or repositories. Do not expose search URLs containing secret values.