diegosouzapw/omniroute/omni-api-keys

Overview

Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.

Authentication

All requests require a valid Bearer token or session cookie. Obtain a token via POST /api/auth/login or configure REQUIRE_API_KEY=false for local development.

Endpoints

GET /api/keys

List API keys

curl http://localhost:20128/api/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys

Create API key

Submit the legacy key settings, or name with a complete policy and optional templateRef containing id and revision. Policy-based creation writes the key and related settings atomically. Submitted edits are final; templateRef is provenance and never replaces the policy. The fresh secret is returned once with Cache-Control no-store. Blocking missing references return 422.

curl -X POST http://localhost:20128/api/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/keys/{id}/template-policy

Preview a key policy without revealing its credential

curl http://localhost:20128/api/keys/{id}/template-policy \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/import

Import a caller-supplied API key without replacing existing keys

Uses the same management authentication as POST /api/keys: dashboard session, local CLI credential, manage/admin-scoped API key, or an admin oma_ access token. read/write oma_ tokens are insufficient. When login is disabled, inference-only imports may be anonymous, but importing manage/admin scopes requires a real management credential, including retries against an existing management-scoped key.

Accepts a 32–256 character ASCII key beginning with sk-, followed only by A–Z, a–z, 0–9, underscore or hyphen. No machine-id or CRC validation is performed. Whitespace is rejected, never trimmed. Configured environment API keys and the internal self-loop credential cannot be imported because they bypass row policy.

An explicit existing id with the same key hash returns 200 and the existing stored policy without mutation; requested name/policy changes are ignored. An existing id with a different value, or the same value at another id, returns 409 without disclosing another id. Without id, a UUID is generated and duplicate values return 409, not 200. New imports return 201. No rekey is performed.

Identity checks and the complete policy insert run in one synchronous SQLite IMMEDIATE transaction. Uses create-key defaults and scope normalization (adds self:usage and removes duplicates). Unknown fields, including isActive, are ignored just as on create; change active state through the existing PATCH route. No settings, providers, combos or session state is imported. This does not change the operator-only import-json restore permissions. Cloud sync is best-effort and asynchronous for new imports only. Secrets use enc:v1 encryption at rest when storage encryption is configured; otherwise upstream plaintext storage applies. Responses contain only id/name, a masked key and whitelisted stored policy fields, never the full secret, hash, key prefix column or machine identifier.

: "${IMPORTED_API_KEY:?Set the caller-supplied sk- key to import}"
curl -X POST http://localhost:20128/api/keys/import \
  -H "Authorization: Bearer <YOUR_TOKEN>" \
  -H "Content-Type: application/json" \
  -d "{\"name\":\"Imported key\",\"key\":\"$IMPORTED_API_KEY\"}"

GET /api/keys/{id}

Get API key

curl http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

PATCH /api/keys/{id}

Update API key

curl -X PATCH http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

DELETE /api/keys/{id}

Delete API key

curl -X DELETE http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/{id}/access

Add or remove allowed models and combos on an API key atomically

Adds or removes allowed models and combos on an API key without lost updates. Serialized per key ID using an in-process async lock. Keys allowing all models (modelAccessMode: all) or all combos (allowedCombos containing 'combo/*') require switchToRestricted: true when adding new models or combos, otherwise returning a 409 Conflict. When switching to restricted mode, the allowlist becomes exactly the net added items (at least one required). Direct concurrent PATCH calls to /api/keys/{id} completely overwrite the policy outside this lock.

curl -X POST http://localhost:20128/api/keys/{id}/access \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/keys/{id}/devices

List devices for an API key

Lists the distinct devices (masked IP + User-Agent fingerprints) tracked for an API key by the in-memory device tracker. IPs are masked before storage; the route never sees the raw client IP.

curl http://localhost:20128/api/keys/{id}/devices \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/{id}/regenerate

POST keys › <id> › regenerate

curl -X POST http://localhost:20128/api/keys/{id}/regenerate \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/keys/{id}/reveal

GET keys › <id> › reveal

curl http://localhost:20128/api/keys/{id}/reveal \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

GET /api/keys/{id}/usage-limits

GET keys › <id> › usage limits

curl http://localhost:20128/api/keys/{id}/usage-limits \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

GET /api/keys/{id}/self-service

GET keys › <id> › self service

Self-service settings, what the key holder can see through /v1/me/status, the providers the key can reach, and an admin preview of its /v1/me/status body (always includes limits and settings-filtered accountQuotas, regardless of scopes).

curl http://localhost:20128/api/keys/{id}/self-service \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

PUT /api/keys/{id}/self-service

PUT keys › <id> › self service

Update the key's self-service settings. Omitted fields keep their value.

curl -X PUT http://localhost:20128/api/keys/{id}/self-service \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/keys/groups

GET keys › groups

curl http://localhost:20128/api/keys/groups \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/groups

POST keys › groups

curl -X POST http://localhost:20128/api/keys/groups \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/keys/groups/{id}

GET keys › groups › <id>

curl http://localhost:20128/api/keys/groups/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

PUT /api/keys/groups/{id}

PUT keys › groups › <id>

Updates the group. Setting isActive to false pauses its allow rules while preserving membership restrictions and deny rules. Other active groups may still grant access unless a deny matches. Keys belonging only to inactive groups have no group grants. Keys without groups remain unrestricted by group policy; per-key restrictions still apply.

curl -X PUT http://localhost:20128/api/keys/groups/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

DELETE /api/keys/groups/{id}

DELETE keys › groups › <id>

curl -X DELETE http://localhost:20128/api/keys/groups/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

GET /api/keys/groups/{id}/keys

GET keys › groups › <id> › keys

curl http://localhost:20128/api/keys/groups/{id}/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/groups/{id}/keys

POST keys › groups › <id> › keys

curl -X POST http://localhost:20128/api/keys/groups/{id}/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

DELETE /api/keys/groups/{id}/keys

DELETE keys › groups › <id> › keys

curl -X DELETE http://localhost:20128/api/keys/groups/{id}/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

GET /api/keys/groups/{id}/permissions

GET keys › groups › <id> › permissions

curl http://localhost:20128/api/keys/groups/{id}/permissions \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

POST /api/keys/groups/{id}/permissions

POST keys › groups › <id> › permissions

curl -X POST http://localhost:20128/api/keys/groups/{id}/permissions \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

DELETE /api/keys/groups/{id}/permissions

DELETE keys › groups › <id> › permissions

curl -X DELETE http://localhost:20128/api/keys/groups/{id}/permissions \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"

Payloads

See the full OpenAPI specification at GET /api/openapi/spec or docs/openapi.yaml for detailed request/response schemas.