API key authentication

v1 (current)

Creating and using an API key.

API keys are created from the portal at /portal/api-keys (requires being signed in). The full key is shown exactly once, at creation time — only a SHA-256 hash and a short prefix are stored, so there's no way to retrieve a lost key; revoke it and create a new one instead.

Creating a key

curl -X POST https://uamsatech.com/api/portal/api-keys \
  -H "Content-Type: application/json" \
  --cookie "access_token=..." \
  -d '{"name": "LecturerCraft integration"}'

Response — the fullKey field only ever appears here

{
  "apiKey": { "id": "...", "name": "LecturerCraft integration", "keyPrefix": "uamsa_live_l7Xn…", "createdAt": "..." },
  "fullKey": "uamsa_live_l7XndS-Kv3ZO0H1wTgIK7mltbUihAiRscbFjjtQWtyE"
}

Use the full key as a Bearer token on any request to the usage API:

bash

curl -X POST https://uamsatech.com/api/v1/usage \
  -H "Authorization: Bearer uamsa_live_l7XndS-Kv3ZO0H1wTgIK7mltbUihAiRscbFjjtQWtyE" \
  -H "Content-Type: application/json" \
  -d '{"productSlug": "lecturercraft", "metric": "lecture_notes_generated", "quantity": 1}'

A revoked key is rejected immediately on the next request (401 Invalid or missing API key.) — there's no grace period.