> For the complete documentation index, see [llms.txt](https://resolvedmarkets.com/llms.txt). Every docs page is also served as Markdown: append `.md` to its URL or send `Accept: text/markdown`.

## API Keys

Every authenticated request must include your API key in the `X-API-Key` HTTP header. Keys are SHA-256 hashed before storage — the plaintext key is shown only once at creation time.

```
X-API-Key: rm_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

| Action | Endpoint | Auth | Details |
| --- | --- | --- | --- |
| Create | `POST /v1/api-keys` | Clerk session | Returns plaintext key once. Store it securely. |
| List | `GET /v1/api-keys` | Clerk session | Shows key prefix, label, status, and usage count. |
| Validate | `GET /v1/api-keys/validate` | X-API-Key | Returns 200 if key is valid, 403 otherwise. |
| Revoke | `DELETE /v1/api-keys/:key` | Clerk session | Permanently deactivates the key (matched by prefix or id). |

**Security best practices**
- Never expose keys in client-side code — use environment variables and server-side proxies.
- Rotate keys periodically by creating a new key, updating apps, then revoking the old one.
- Label keys by environment or service (e.g., `prod-backend`, `staging-analytics`).