API access keys

API access keys are tenant-scoped service accounts with hashed bearer tokens.

Tenant owners and admins can create keys from Settings > API Access using presets for General API, OpenClaw, Hermes, or Custom integrations.

Token format

dmagt_<public>_<secret>

The raw token is shown once. List responses only show masked metadata.

Environment block

DEALMELD_API_URL=https://api.dealmeld.io
DEALMELD_TENANT_ID=<tenant uuid>
DEALMELD_API_KEY=dmagt_<public>_<secret>

Revocation

Revoking an API access key revokes the service account and all active tokens under it. Revoking an individual token leaves the parent service account active.

Revocation is enforced on the next request because token validation checks database revoked_at fields.

Audit trail

Credential management actions are audited with tenant and actor context:

Action	Entity type
Key created	agent_service_account
Token created	agent_service_token
Key revoked	agent_service_account
Token revoked	agent_service_token

Audit payloads include masked token values only, never raw tokens or token hashes.