API Keys
Create, view, test, and revoke API Keys in the settings center for programmatic access.
MuseMVP uses the Better Auth API Key plugin to provide full API Token management. Logged-in users can create, view, test, and revoke API Keys on the Settings → API Keys page (/app/settings/tokens) for programmatic access to protected APIs.
Access
Path: /app/settings/tokens. Requires login; unauthenticated users are redirected to the login page.
Overview
Create API Key
Custom name, expiry, prefix, and metadata. Full key is shown only once after creation.
View & Manage
Table view of all keys (name, prefix, status, expiry); per-key actions menu to open the detail dialog or delete.
Online Test
Test dialog with a built-in panel to verify key validity and remaining quota; prefills the most recently created key.
Secure Storage
Keys stored as hashes; full value shown only at creation, not recoverable later.
Page & Routes
| Path | Description |
|---|---|
/app/settings/tokens | API Token management page (login required) |
Core Features
Create API Key
Configurable options:
| Parameter | Description |
|---|---|
name | Optional, human-readable label |
expiresIn | Optional, expiry in seconds |
prefix | Optional, key prefix for identification |
metadata | Optional, custom metadata |
Key Shown Once
The full key is displayed only once after creation. Save it securely; it cannot be retrieved later.
Verify API Key
Use POST /api/api-keys/verify to validate a key:
// Request body
{ "key": "your-api-key-string" }
// Response (valid)
{
"valid": true,
"key": { "id", "name", "referenceId", "remaining", "expiresAt", ... },
"error": null
}
// Response (invalid)
{
"valid": false,
"key": null,
"error": { "code": "KEY_NOT_FOUND", "message": "..." }
}This endpoint is protected by authMiddleware and requires a valid session cookie. Verification ensures the key belongs to the current user.
Implementation
Data Flow
Frontend: ApiKeyManager uses useApiKeysQuery to fetch keys from Better Auth.
Create/Update/Delete: Via authClient.apiKey.create/update/delete.
Verify: POST /api/api-keys/verify calls auth.api.verifyApiKey and checks referenceId ownership.
API Endpoints
| Method | Path | Description |
|---|---|---|
POST | /api/api-keys/verify | Verify API Key (login required) |
Better Auth Native APIs
Create, list, update, delete are provided by Better Auth's apiKey plugin via authClient.apiKey.*.
Using in Business APIs
To validate API Keys in custom Hono routes, use Better Auth's verifyApiKey or call auth.api.verifyApiKey with the key from the request header. After validation, use the returned referenceId for subsequent business logic.