> This page is for version v1 (default).
> For other versions, use one of these documentation indexes:
> - v1 (default): https://platform.bctrl.ai/v1/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# api-keys Commands

> Manage api-keys

Manage api-keys

Output formatting flags (`--json`, `--jq`, and `--template`) are documented once in [Output Formatting](/cli/output) and are omitted from the tables below.

## `bctrl api-keys create`

Create an organization or subaccount API key. The secret is returned once in the response. To rotate a key, create its replacement first, cut traffic over, then revoke the old key — key prefixes identify which key made a request.

```bash
bctrl api-keys create [flags]
```

| Flag                      | Description                                        |
| ------------------------- | -------------------------------------------------- |
| `--headers <json>`        | API headers: inline JSON, @file, or - for stdin    |
| `--api-version <date>`    | Dated API contract (default: 2026-10-03)           |
| `--space <id-or-name>`    | Select an authorized Space (BCTRL-Space)           |
| `--subaccount-id <id>`    | Effective subaccount context (BCTRL-Subaccount-Id) |
| `--idempotency-key <key>` | Retry key for this operation                       |
| `--body <json>`           | Request body: inline JSON, @file, or - for stdin   |

## `bctrl api-keys delete`

Revoke an API key immediately. Rotation is create-then-revoke: create the replacement, cut over, then revoke the old key.

```bash
bctrl api-keys delete <keyId> [flags]
```

| Flag                      | Description                                        |
| ------------------------- | -------------------------------------------------- |
| `--headers <json>`        | API headers: inline JSON, @file, or - for stdin    |
| `--api-version <date>`    | Dated API contract (default: 2026-10-03)           |
| `--space <id-or-name>`    | Select an authorized Space (BCTRL-Space)           |
| `--subaccount-id <id>`    | Effective subaccount context (BCTRL-Subaccount-Id) |
| `--idempotency-key <key>` | Retry key for this operation                       |
| `--yes`                   | Confirm this destructive operation                 |

## `bctrl api-keys list`

List active API keys. Use subaccountId to filter tenant keys.

```bash
bctrl api-keys list [flags]
```

| Flag                            | Description                                        |
| ------------------------------- | -------------------------------------------------- |
| `--query <json>`                | Query object: inline JSON, @file, or - for stdin   |
| `--params <json>`               | Alias for --query                                  |
| `--cursor <value>`              | Query parameter cursor                             |
| `--order <value>`               | Query parameter order                              |
| `--limit <value>`               | Query parameter limit                              |
| `--query-subaccount-id <value>` | Query parameter subaccountId                       |
| `--type <value>`                | Query parameter type                               |
| `--headers <json>`              | API headers: inline JSON, @file, or - for stdin    |
| `--api-version <date>`          | Dated API contract (default: 2026-10-03)           |
| `--space <id-or-name>`          | Select an authorized Space (BCTRL-Space)           |
| `--subaccount-id <id>`          | Effective subaccount context (BCTRL-Subaccount-Id) |