Help · Operators

API Keys for Scripts

A script or a bot calls the Operator API with a key. Make it on the Agents page, choose read or manage, and send it as Authorization: Bearer pko_… A key never moves money, and you can revoke it at any time.

Open in the app All help topics
example
curl -s https://proofkit.org/api/v1/operator/me \
  -H "Authorization: Bearer pko_…"

An operator API key lets a script or a bot call the Operator API as you, with no sign-in. An AI agent that can sign in does not need one: see Connect an AI Agent.

Make a key

  1. Open the Agents page, signed in to your operator account. Your email address must be confirmed, and when the account has a second factor, the session must have passed it.
  2. Under Make a key, give the key a name of 1 to 40 characters, such as the machine or the tool that will use it. Make one key for each script, so that you can revoke one without the others.
  3. Choose its scopes and when it expires, and press Make key. The key is shown once: copy it now, and keep it in the script's environment, not in a file that is committed.

ProofKit keeps only the key's hash, and tells you by email, and by Telegram where it is linked, that a key was made. An account holds at most 10 live keys.

Scopes and expiry

  • read reads your nodes, their checks, metrics and events, links and invitations, your earnings, your balance and your payouts. Every key has it.
  • manage also registers, changes, reinstalls, restarts and deletes nodes, links entries to exits and makes invitations. A call that changes something, made with a key that has only read, is refused with 403 INSUFFICIENT_SCOPE.
  • A key expires in 30 days, 90 days (the default), 1 year or never. An expired or revoked key is refused with 401.

Use it

Send the key in the Authorization header of every call: Authorization: Bearer pko_…. The Operator API is at https://proofkit.org/api/v1/operator, and GET /me is the call to start with. A key is allowed 300 requests a minute, of which at most 60 may be writes. The same key connects an agent that cannot sign in to the operator MCP server.

Revoke a key

Press Revoke beside the key on the Agents page and confirm. The script's next call is refused with 401. A revoked key cannot be brought back: make a new one to replace it.

What no key can do

  • Touch money. A key cannot link or change the wallet, withdraw, or request, prepare or send a payout. Claim is your own press on the Wallet page.
  • Change who you are. The password, the email address, the second factor and the Telegram link stay yours.
  • Make, list or revoke keys. Only you, signed in, can, so a stolen key cannot make another.
  • Read your users. No answer names a user, a user's address or a subscription link.
  • Approve a node. ProofKit reviews a public node before it takes users.

The operator docs are the reference, and the API explorer sends calls with your key.