Skip to main content
Every request to the Pioneer API requires an API key passed in the X-API-Key header. Create keys in the Pioneer dashboard, then use the key management endpoints to list and revoke existing keys programmatically.
Store API keys in environment variables rather than hardcoding them in source code. For example, set PIONEER_API_KEY in your environment and read it at runtime. Never commit API keys to version control.

​
Create an API key

POST /create-api-key Generates a new API key associated with your account. This endpoint is used by the Pioneer dashboard and requires a browser session. Calls authenticated with an existing API key are rejected with 403 Forbidden to prevent credential chaining. Request body
​
string
required
A descriptive name to identify this key. Use names that reflect the key’s purpose or the service it belongs to, for example "ci-pipeline" or "production-inference".
Do not use an existing API key to create another API key. X-API-Key authentication is not accepted for this endpoint; create keys from Settings -> API Keys in the dashboard.
Response
​
string
The full API key value. This is the only time it is returned in plaintext — copy it immediately and store it somewhere secure such as a secrets manager or environment variable.
​
string
Unique identifier for the key. Use this ID when revoking the key.
​
string
The name you assigned to the key.
​
string
ISO 8601 timestamp of when the key was created.
​
string
Last digits of the generated key for display and identification.
​
string | null
Optional ISO 8601 expiration timestamp, or null when the key does not expire.
​
string
Team the key is bound to.
​
boolean
Whether Pioneer created a Stripe customer record during key creation.
The full key value is only returned at creation time. If you lose it, you must revoke the key and create a new one.

​
List API keys

GET /list-api-keys Returns all API keys associated with your account. Key values are masked in the response — only metadata such as name and creation date are returned.
Response
​
object[]
Array of API key metadata objects.
​
number
Number of keys returned.

​
Revoke an API key

DELETE /delete-api-key Permanently revokes an API key. Any requests using the revoked key will immediately receive 401 Unauthorized responses. Request body
​
string
required
The unique ID of the key to revoke, as returned by GET /list-api-keys.
Revoking a key is immediate and irreversible. Ensure any services using the key are updated to use a replacement key before revoking the old one to avoid service interruptions.
Response Returns 200 OK with a JSON success body.
​
boolean
Whether the key was revoked.
​
string | null
Human-readable status message.