Docs

REST API

The same HTTP API the CLI uses. Reach for it where Node.js isn't available or you need something the commands don't do; otherwise the CLI is simpler.

Overview

The base URL is https://apivault.tech. Requests and responses are JSON. Keys are identified by their id, which the list endpoint returns. Every request is listed on Endpoints.

Authentication

Send a token as a Bearer token in the Authorization header:

Authenticated requestShell
curl https://apivault.tech/api/keys \
  -H "Authorization: Bearer $APIVAULT_TOKEN"
TokenReachesLimited by
Service token (av_live_…)Key endpoints and /api/cli/meIts scopes, environment pin and IP allowlist
Device token, from apivault loginKey endpoints and the device-token endpointsYour role in the project

MCP OAuth tokens are not accepted here; they only work on the MCP server. Use a service token for anything automated.

Choosing a project

A service token always works in its own project. Naming a different one returns 403 PROJECT_MISMATCH.

A device token can reach every project you belong to, so name the one you want with the X-Project-Id header or a projectId query parameter. Both accept an ID or a slug.

Choose a projectShell
curl https://apivault.tech/api/keys \
  -H "Authorization: Bearer $APIVAULT_TOKEN" \
  -H "X-Project-Id: my-app"

Sending a vault key

For a project in custom encryption mode, requests that encrypt or decrypt must include the vault key in an X-Vault-Key header. If it contains non-ASCII characters, send it base64-encoded in X-Vault-Key-B64 instead. Listing keys and editing metadata don't need it.

Errors

Errors return a JSON body with an error message and, where one applies, a code. Every code is listed on error codes, and the limits you can run into are on limits.