Self-serve account routes
Session-authenticated routes for the signed-in user's personal Starkscan workspace and self-serve API keys.
In this guide
Loading documentation content…
Session-authenticated routes for the signed-in user's personal Starkscan workspace and self-serve API keys.
In this guide
Use /v1/me/* when you are acting as the signed-in operator of your personal Starkscan workspace rather than as an external API-key caller.
These routes back the hosted /api-key experience and expose the same personal-workspace self-serve control plane over HTTP.
Do not send X-Starkscan-Api-Key to this lane.
Authenticate with a Better Auth session instead:
GET / HEAD / OPTIONS) can use the Starkscan session cookiesAuthorization: Bearer <better_auth_session_token>If the session is missing or invalid, Starkscan returns 401 Unauthorized.
If you try to POST or DELETE with cookies only, Starkscan returns 403 Forbidden with a WWW-Authenticate: Bearer header.
| Route | What it does |
|---|---|
GET /v1/me/api-keys | list self-serve keys for the authenticated personal workspace |
POST /v1/me/api-keys | issue or rotate the default live read key |
DELETE /v1/me/api-keys/{public_id} | revoke one self-serve key |
GET /v1/me/usage | load recent usage, failures, and per-key aggregates for the authenticated personal workspace |
GET /v1/me/api-keys returns metadata only. It never returns plaintext secrets.GET /v1/me/api-keys returns a bounded newest-first slice plus truncated=true when older historical keys exist outside the response.POST /v1/me/api-keys returns the plaintext key once for the new or rotated default key.POST /v1/me/api-keys revokes it in the same operation and returns action=rotated.DELETE /v1/me/api-keys/{public_id} revokes the selected key and returns its final metadata snapshot.GET /v1/me/usage is a recent operational window, not a billing export, and it surfaces truncation flags on every bounded list.POST and DELETE on /v1/me/* are bearer-only on purpose. Starkscan rejects cookie-only mutations to avoid CSRF on key rotation/revocation.Cache-Control: no-store on purpose.Export a session token if you are calling this lane outside the hosted browser:
export MEZCAL_BASE_URL="https://<your-mezcal-host>/api"
export MEZCAL_SESSION_TOKEN="<better_auth_session_token>"List keys:
curl \
-H "Authorization: Bearer $MEZCAL_SESSION_TOKEN" \
"$MEZCAL_BASE_URL/v1/me/api-keys"Issue or rotate the default key:
curl -X POST \
-H "Authorization: Bearer $MEZCAL_SESSION_TOKEN" \
"$MEZCAL_BASE_URL/v1/me/api-keys"Revoke one key:
curl -X DELETE \
-H "Authorization: Bearer $MEZCAL_SESSION_TOKEN" \
"$MEZCAL_BASE_URL/v1/me/api-keys/<public_id>"Inspect recent usage:
curl \
-H "Authorization: Bearer $MEZCAL_SESSION_TOKEN" \
"$MEZCAL_BASE_URL/v1/me/usage"plaintextKey, apiKey, and revokedPublicIdstotalRequeststotalFailuresperKeyperKeyTruncatedrecentRequestsrecentRequestsTruncatedrecentFailuresrecentFailuresTruncatedSee the API reference for the exact fields and schemas.