Skip to main content
Updated May 10, 2026 The raff api-key command group manages API keys for the account. Each key has a name, a rate-limit tier, an optional expiration, and an active flag. The plaintext secret is returned once at create or regenerate — it cannot be retrieved later. Every subcommand supports --output json for scripting. Aliases: raff api-keys, raff key, raff keys.

​
Subcommand index

​
list

List API keys for the account. Output columns: ID, NAME, PREFIX, ACTIVE, EXPIRES. Secrets are never returned by list.

​
get

Show key metadata — ID, name, prefix, active flag, expiration. The secret is never returned by get.

​
create

Create a new API key. Required: --name. The plaintext secret is printed once — copy it immediately. The default rate-limit tier is standard; high requires support approval.

​
update

Update one or more metadata fields. At least one flag must be provided. Use --active false to suspend a key without revoking — re-enable later by setting --active true.

​
regenerate

Rotate the secret. The new secret is printed once; the old secret stops working immediately.

​
revoke

Permanently revoke the key. Any client using it will fail immediately. Pass --force to skip the confirmation prompt.

raff_api_key (Terraform)

Declarative API key management.

Role commands

Roles control what a key can do.

Configure CLI auth

Where to put the secret after creating it.
Last modified on May 11, 2026