> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tattoo.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Current behavior for retired legacy TattooAPI API key routes.

# API Keys

Local TattooAPI API key management is retired.

Machine and private worker credentials are created, rotated, and revoked in the partner portal. TattooAPI validates incoming `X-API-Key` values, then resolves the non-secret credential identity to a TattooAPI actor mapping.

This is WorkOS organization API-key M2M authentication, not OAuth client credentials. WorkOS validates the key and owns its lifecycle; TattooAPI uses the non-secret key ID to load a Convex service-actor mapping and enforce route, tenant, studio, artist, and review boundaries.

## Retired Endpoints

* `GET /api-keys`
* `POST /api-keys`
* `GET /api-keys/{id}`
* `PUT /api-keys/{id}`
* `DELETE /api-keys/{id}`

These routes return `410 Gone` before legacy local key storage is used.

## Response

```json theme={"dark"}
{
  "success": false,
  "error": {
    "message": "Local TattooAPI API key management is retired. Create and revoke machine credentials in the partner portal.",
    "code": "LOCAL_API_KEYS_RETIRED"
  },
  "meta": {
    "authProvider": "partner_credentials",
    "replacement": "Partner API Keys",
    "timestamp": "2026-04-30T01:05:56.746Z"
  }
}
```

## Current Machine Auth

Use partner API keys for server-to-server calls:

```bash theme={"dark"}
curl "$TATTOO_API_BASE_URL/search?q=tattoo" \
  -H "X-API-Key: $TATTOO_PARTNER_API_KEY"
```

## Security Boundary

* Secret API key values live in the partner portal and local or deployed secret managers only.
* TattooAPI stores non-secret credential identity metadata and actor mappings.
* Valid keys without a mapped TattooAPI actor return `403`.
* WorkOS key permissions and TattooAPI mapping permissions are separate layers; internal service capabilities are never self-service key scopes.
* Public writes remain blocked.

<Warning>
  Do not store API key values in git, Mintlify, source-pack reports, prompts, screenshots, or public examples.
</Warning>