Account API keys
An account API key (ctk_…) belongs to one workspace instead of a person, so CI and other automation can call the API. It acts in that workspace with the role it was given. Admins and owners manage account API keys, and only owners manage keys with the owner role.
The AccountApiKey object
A workspace's API key that acts with a role instead of as a person.
Attributes
idstringRequiredUnique ID of the account API key.
namestringRequiredThe key's name, such as Release CI.
rolestringRequiredThe workspace role the key acts with.
owneradminmemberviewerlastFourstringRequiredThe key's last four characters, to tell keys apart.
createdAtstringRequiredWhen the key was created, as an ISO 8601 timestamp.
{ "id": "Ak2WqH9sDf5T", "name": "Release CI", "role": "member", "lastFour": "cZaE", "createdAt": "2026-10-01T16:20:00.000Z"}List account API keys
GET/Returns the workspace's account API keys without their values. Revoked keys are left out. Only admins and owners can list them.
Path parameters
slugstringRequiredThe workspace's slug or ID, such as acme.
Returns
Returns an array of AccountApiKey objects. Status 200.
Errors
- 400
InvalidInputThe request is malformed, or a value is not allowed.- 401
UnauthorizedThe request has no valid API key.- 403
ForbiddenThe key's user or role may not do this.- 404
NotFoundThe workspace or object does not exist, or the caller cannot see it.- 409
ConflictThe change conflicts with current data, such as a slug that is already in use.- 500
InternalClanker Ship failed to handle the request. Retry, or report the response's x-request-id.
curl https://api.qa.clankership.net/v1/workspaces/acme/account-api-keys \ -H "Authorization: Bearer $CLANKER_API_KEY"[ { "id": "Ak2WqH9sDf5T", "name": "Release CI", "role": "member", "lastFour": "cZaE", "createdAt": "2026-10-01T16:20:00.000Z" }]Create an account API key
POST/Creates a key that acts in this workspace with the given role. The response holds the key's value, which is never shown again. Only admins and owners can create account API keys, and only owners can grant the owner role.
Path parameters
slugstringRequiredThe workspace's slug or ID, such as acme.
Body parameters
namestringRequiredA name for the key, 1 to 100 characters, such as Release CI.
rolestringRequiredThe role the key acts with. Only owners can choose owner.
owneradminmemberviewerReturns
Returns an object with these fields. Status 200.
A new account API key with its value, which is never shown again.
idstringRequiredUnique ID of the account API key.
namestringRequiredThe key's name.
rolestringRequiredThe workspace role the key acts with.
owneradminmemberviewersecretstringRequiredThe key, starting with ctk_. It is shown only in this response.
Errors
- 400
InvalidInputThe request is malformed, or a value is not allowed.- 401
UnauthorizedThe request has no valid API key.- 403
ForbiddenThe key's user or role may not do this.- 404
NotFoundThe workspace or object does not exist, or the caller cannot see it.- 409
ConflictThe change conflicts with current data, such as a slug that is already in use.- 500
InternalClanker Ship failed to handle the request. Retry, or report the response's x-request-id.
curl -X POST https://api.qa.clankership.net/v1/workspaces/acme/account-api-keys \ -H "Authorization: Bearer $CLANKER_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "Release CI", "role": "member" }'{ "id": "Ak2WqH9sDf5T", "name": "Release CI", "role": "member", "secret": "ctk_4mT8vQ2xR7nL9pW3kS6dH1jF5bY0cZaE"}Update an account API key
PATCH/Changes the key's name and role; its value stays the same. Only admins and owners can update account API keys, and only owners can change an owner key or grant the owner role.
Path parameters
slugstringRequiredThe workspace's slug or ID, such as acme.
idstringRequiredThe account API key's ID, such as Ak2WqH9sDf5T.
Body parameters
namestringRequiredA name for the key, 1 to 100 characters, such as Release CI.
rolestringRequiredThe role the key acts with. Only owners can choose owner.
owneradminmemberviewerReturns
Returns an object with these fields. Status 200.
okbooleanRequiredAlways true: the change was made.
trueErrors
- 400
InvalidInputThe request is malformed, or a value is not allowed.- 401
UnauthorizedThe request has no valid API key.- 403
ForbiddenThe key's user or role may not do this.- 404
NotFoundThe workspace or object does not exist, or the caller cannot see it.- 409
ConflictThe change conflicts with current data, such as a slug that is already in use.- 500
InternalClanker Ship failed to handle the request. Retry, or report the response's x-request-id.
curl -X PATCH https://api.qa.clankership.net/v1/workspaces/acme/account-api-keys/{id} \ -H "Authorization: Bearer $CLANKER_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "Release CI", "role": "member" }'{ "ok": true}Revoke an account API key
POST/Revokes the key, so its next request fails with Unauthorized. Only admins and owners can revoke account API keys, and only owners can revoke an owner key.
Path parameters
slugstringRequiredThe workspace's slug or ID, such as acme.
idstringRequiredThe account API key's ID, such as Ak2WqH9sDf5T.
Returns
Returns an object with these fields. Status 200.
okbooleanRequiredAlways true: the change was made.
trueErrors
- 400
InvalidInputThe request is malformed, or a value is not allowed.- 401
UnauthorizedThe request has no valid API key.- 403
ForbiddenThe key's user or role may not do this.- 404
NotFoundThe workspace or object does not exist, or the caller cannot see it.- 409
ConflictThe change conflicts with current data, such as a slug that is already in use.- 500
InternalClanker Ship failed to handle the request. Retry, or report the response's x-request-id.
curl -X POST https://api.qa.clankership.net/v1/workspaces/acme/account-api-keys/{id}/revoke \ -H "Authorization: Bearer $CLANKER_API_KEY"{ "ok": true}