API keys

Farshore Labs API keys are long-lived bearer credentials intended for backend integrations. Every key:

• Is owned by one Farshore account and inherits that account’s subscriptions.
• Is scoped to one or more service IDs (or to all, if you choose).
• Counts against a per-service monthly quota (default 20,000 calls per service, per UTC month).
• Can be revoked or rotated at any time from the dashboard. Revocation takes effect within 60 seconds across every service.

Tokens look like this:

fsl_live_AB23CDE45FGH67IJ8KLM9NOP0QRS1TUV2WXY3ZAB4CDE5FGH6IJ7KLMNO

• Prefix fsl_live_ so GitHub secret-scanning can detect leaks.
• 52 characters of RFC 4648 base32 (A–Z, 2–7) after the prefix — 256 bits of entropy.
• Stored only as a SHA-256 hash. The raw value is returned exactly once at creation and never again. The dashboard shows only the first 16 characters thereafter.

From the web app: Account › API keys → Create key. From the identity API:

POST /me/api-keys
Authorization: Bearer <session JWT>
Content-Type: application/json

{
  "name": "backend-prod",
  "allowedServiceIds": ["azure-availability"],
  "expiresAt": "2027-05-22T00:00:00Z"
}

Response (200):

{
  "keyId": "9c1e9f2a-9c0d-4f1b-8a35-3e09b27b48a4",
  "name": "backend-prod",
  "prefix": "fsl_live_AB23CDE4",
  "token": "fsl_live_AB23CDE45FGH67IJ8KLM9NOP0QRS1TUV2WXY3ZAB4CDE5FGH6IJ7KLMNO",
  "allowedServiceIds": ["azure-availability"],
  "monthlyLimit": 20000,
  "expiresAt": "2027-05-22T00:00:00Z",
  "createdAt": "2026-05-22T14:11:09Z"
}

The token field is returned only on this call. If you lose it, revoke the key and create a new one.

curl https://api.farshorelabs.com/azure-availability/v1/availability \
  -H "Authorization: Bearer fsl_live_AB23CDE45FGH67IJ8KLM9NOP0QRS1TUV2WXY3ZAB4CDE5FGH6IJ7KLMNO" \
  -G \
  --data-urlencode "service=Microsoft.Compute/virtualMachines" \
  --data-urlencode "sku=Standard_D4s_v5" \
  --data-urlencode "region=eastus2"

Every successful response includes:

X-RateLimit-Limit:     20000
X-RateLimit-Remaining: 19978
X-RateLimit-Reset:     2026-06-01T00:00:00Z

• GET /me/api-keys returns metadata for every key on your account (active and revoked). Raw tokens are never returned.
• DELETE /me/api-keys/{keyId} revokes the key. Only the owner can revoke; the request is authenticated with the session JWT, never with the key being revoked.
• Rotation is “create new, deploy, delete old”. We do not perform implicit rotation on your behalf.

• Maximum keys per account: 10 (configurable per account on request).
• Default monthly quota: 20,000 requests per service. See Rate limits.
• Keys cannot be transferred between accounts.

• One key per workload — name them so leakage is traceable.
• Scope keys to the smallest set of services they need.
• Set an expiry that matches the deployment lifetime.
• Treat keys as production secrets: secret manager, .gitignore for local development, and rotation on personnel changes.