ironflow apikey

Manage API keys for authentication. Create, list, delete, and rotate API keys.

ironflow apikey <subcommand> [flags]

Subcommands:

Subcommand	Description
create	Create a new API key
list	List all API keys
delete	Delete an API key
rotate	Rotate an API key

ironflow apikey create

Create a new API key with the given name. Returns the key value which must be saved immediately.

ironflow apikey create <name> [flags]

Arguments:

Argument	Required	Description
name	Yes	Name for the new API key

Flags:

Flag	Short	Type	Default	Description
--env		string		Environment ID to scope the key to
--role		string[]		Role ID to assign (can be specified multiple times). Without it, a tenant key gets the role_viewer role; a platform key gets none
--tool-scope		string[]		Agent tool scope to grant (can be specified multiple times)
--expires		string		Expiration duration (e.g. 720h for 30 days)
--platform		bool	false	Create a platform-scoped key (ifplatform_ prefix)
--server	-s	string		Server URL override

--platform needs the platform:keys:manage permission. A platform key accepts only platform-scoped roles and is not bound to an environment, so the server ignores --env.

Examples:

# Create a basic API key
ironflow apikey create my-key

# Create a key with roles
ironflow apikey create my-key --role role_abc123 --role role_def456

# Create a key scoped to an environment with expiration
ironflow apikey create my-key --env env_abc123 --expires 720h

# Create an agent key with tool scopes
ironflow apikey create agent-bot --role role_abc123 --tool-scope billing-tools --tool-scope reporting-tools

# Create a platform key for cross-tenant operations
ironflow apikey create my-platform-key --platform

ironflow apikey list

List all API keys with their IDs, names, prefixes, roles, and timestamps.

ironflow apikey list [flags]

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--platform		bool	false	List only platform-scoped keys
--server	-s	string		Server URL override

Output:

ID            NAME      PREFIX            ROLES          CREATED               LAST USED             EXPIRES
ak_abc123     my-key    ifkey_a1b2c3d4    role_abc123    2026-01-01T00:00:00Z  2026-03-01T12:00:00Z  -

Examples:

# List all API keys
ironflow apikey list

# List platform keys only
ironflow apikey list --platform

# List as JSON
ironflow apikey list --json

ironflow apikey delete

Delete an API key by its ID. The key is immediately revoked, and so are the desktop sessions minted from it.

ironflow apikey delete <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	API key ID to delete

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Examples:

ironflow apikey delete ak_abc123

ironflow apikey rotate

Rotate an API key by its ID. Creates a new key with the same name, environment, roles, expiry, and tool scopes. The old key is immediately revoked, and so are the desktop sessions minted from it.

ironflow apikey rotate <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	API key ID to rotate

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override
--json		bool	false	Output as JSON (machine-readable)

Examples:

ironflow apikey rotate ak_abc123

---