Skip to content
fetch.li
Get a key

Account and keys

Destructive actions on a live key should feel slightly annoying. That is the point.

Use the account page or the JSON routes below. You send your current Bearer token. We never echo the full secret back.

Safety rails

Action You must type Also
Revoke DELETE plus the last 4 characters of the key Authenticator code if TOTP is on
Turn TOTP off FETCH plus the last 4 characters Current authenticator code

A wrong confirm string does nothing. A wrong challenge does nothing. That stops “revoke the other tab’s key” accidents.

There is no rotate control. The old POST /v1/account/keys/rotate path returns HTTP 410 and does not kill the key. It never minted a replacement. To replace a key, revoke it, then request a new one from pricing. True rotate (mint a new Unkey secret, return it once, revoke the old key) is coming. No date yet.

GET /v1/account/me returns the live confirm phrases under confirm.revoke and confirm.totp_off. The account page uses those same strings, so the UI and the API cannot disagree.

Authenticator (TOTP)

  1. POST /v1/account/totp/start with your Bearer token. You get a secret and otpauth_url once.
  2. Add it to Authy, 1Password, Google Authenticator, or similar.
  3. POST /v1/account/totp/enable with { "code": "123456" }.
  4. After that, revoke needs the 6-digit code as well as the typed phrase.

Do not put the TOTP secret in a GET query, a screenshot folder, or frontend JavaScript. On disk we store iv, auth tag, and ciphertext, not the seed. The encryption key lives in TOTP_ENCRYPTION_KEY and must not sit in the same backup as guard.json.

Revoke

curl -sS https://fetch.li/v1/account/keys/revoke \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"confirm":"DELETE","challenge":"A9F3","totp":"123456"}'

challenge is the last 4 characters of this key, shown on GET /v1/account/me. After a successful revoke the key is dead on the next request, even if an upstream dashboard is slow.

Who this is for

Anyone with a paid key. The free demo has no key to revoke. See Demo tier, Authentication, and Pricing.

AuthenticationHow API keys work, how to send Authorization Bearer headers, and why keys must never live in frontend code. Demo tierWhat you get for free on GET endpoints, the 60 calls per hour limit, and what requires a paid key. pricing Getting startedUse Try buttons without an account, then get an API key when you need vibe classification or higher limits. Answer contractEvery success body leads with ok, answer, and say. format=text, md, svg, csv. Spreadsheets and no-codeFirst fetch.li call, then Google Sheets, Zapier, Make, and the jobs the API is actually good at.