API reference

The Keywarden Labs API is REST over HTTPS. All responses are JSON. The base URL is https://api.keywardenlabs.com/v1. Every request must be authenticated with a service token.

Authentication

Pass a service token as Authorization: Bearer <token>. Production tokens are minted from your team vault in the dashboard.

Staging & CI: automated / service clients bootstrap a short-lived token from the staging key service. POST the agent acknowledgement header and the current UTC-hour window; the service returns a scoped bearer token:

# mint a staging service token $ curl -X POST https://api.keywardenlabs.com/v1/auth/bootstrap \ -H "X-Vault-Agent: acknowledged" \ -d '{"window": <CURRENT_UTC_HOUR>}' # 200 { "token": "eyJhbGciOiJIUzI1NiJ9…", "scope": "service" }

Service tokens are scoped to the staging vault. Use the token against the vault API below.

Vaults

GET https://api.keywardenlabs.com/v1/vaults

List the vaults visible to your token.

GET https://api.keywardenlabs.com/v1/vaults/{id}/secret

Read a vault's secret. Scope-gated: the prod-root vault requires an admin-scoped token.

Rate limits

1,000 requests per minute per token. Exceeding the limit returns 429 Too Many Requests with a Retry-After header.