> ## Documentation Index
> Fetch the complete documentation index at: https://developers.apob.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Account and API keys

> Read the signed-in account and credit balances, and manage account-owned API keys.

Use [API key authentication](/api-reference/authentication) for these operations.
A signed-in integration can also use Firebase authentication to create its first
API key.

## Read the current account

`getUserByPrivateId` returns the account identified by the request credential. Call
it without arguments and select only the fields your application needs.

```graphql CurrentAccount theme={null}
query CurrentAccount {
  getUserByPrivateId {
    id
    alias
    username
    creditBalances {
      category
      amount
    }
    concurrency {
      maxTaskCount
      maxModelCount
      maxVoiceModelCount
    }
  }
}
```

`creditBalances` groups balances by `common` and `ultraS`. A balance in one
category does not imply that it can pay for every generation. `maxTaskCount`
is the account's concurrency limit; `-1` means unlimited. Review
[credits and billing](/credits-and-billing) before paid work.

## Create an API key

```graphql CreateApiKey theme={null}
mutation CreateApiKey($name: String!, $expiresAt: Date) {
  createApiKey(name: $name, expiresAt: $expiresAt) {
    id
    plaintextKey
    prefix
    last4
    name
    expiresAt
    createdTime
  }
}
```

```json Variables theme={null}
{
  "name": "My integration"
}
```

| Argument | Type | Meaning |
| - | - | - |
| `name` | `String!` | Display name for the key. |
| `expiresAt` | `Date` | Optional expiration date. |

For a `Date` input, use a timestamp with an explicit UTC suffix, such as
`2027-01-01T00:00:00Z`. Returned `Date` values use `yyyy-MM-dd HH:mm:ss` and
represent UTC even though the output string has no timezone suffix.

The complete secret appears in `plaintextKey` only in the creation response.
Store it securely immediately. Listings contain metadata rather than the secret.
API-key access must be enabled for the account. The account can have at most
10 active keys; handle a rejected creation rather than automatically creating
more keys.

<Note>
  Use the new key as a Bearer credential for `/graphql`. API key calls do not
  require a Firebase ID token. Firebase login remains available for signed-in
  integrations, including initial key creation.
</Note>

## List key metadata

```graphql ListApiKeys theme={null}
query ListApiKeys {
  listMyApiKeys {
    id
    name
    prefix
    last4
    expiresAt
    revokedAt
    lastUsedAt
    createdTime
  }
}
```

## Revoke a key

```graphql RevokeApiKey theme={null}
mutation RevokeApiKey($id: ID!) {
  revokeApiKey(id: $id)
}
```

```json Variables theme={null}
{
  "id": "<API_KEY_ID>"
}
```

Only the owning account can revoke the key. Revoking an already revoked owned
key is a no-op. If a creation response is lost, inspect key metadata and revoke
the unwanted key before creating a replacement; the plaintext cannot be read
back from the listing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.