Split your integration into narrowly scoped server-side credentials with optional CIDR and expiry restrictions.
Child keys cannot receive scopes the caller does not already possess, secrets are shown once, and a key cannot revoke itself.
| Method | Path | Required scope | Description |
|---|---|---|---|
| GET/POST | /workspace/api-keys | keys:read/write | List keys or create a scoped child key. |
| DELETE | /workspace/api-keys/{api_key_ref} | keys:write | Revoke another key in the same tenant. |
curl --request POST 'https://phylex.net/api/proxy/reseller-api/v1/workspace/api-keys' --header 'Authorization: Bearer phxrk_REPLACE_WITH_YOUR_KEY' --header 'Content-Type: application/json' --data '{"name":"production-orders","scopes":["catalog:read","customers:read","orders:write"],"allowed_cidrs":["203.0.113.10/32"],"expires_in_days":90}'