---
name: bijection-api-keys-vllnt
description: "Evaluate and integrate the Api Keys Vllnt component with Bijection."
---

# Api Keys Vllnt

Bijection component for secure API key management — create, validate, revoke, rotate, and track usage

- Package: @bijectionhq/api-keys-vllnt
- Category: Authentication
- Status: Reference
- License: MIT
- Bijection source (repository access required): https://github.com/bijectionhq/api-keys-vllnt/tree/de026b054d4286092b16f7961271a301469990c3
- Upstream: https://github.com/vllnt/convex-api-keys/tree/9b260a848958c75e80fe6684899f33af538a6865
- Documentation: https://docs.bijection.com/components/using
- Directory: https://bijection.com/components/api-keys-vllnt

## Get the source

Bijection repository access is required. Request access at https://bijection.com/contact.

```sh
git clone https://github.com/bijectionhq/api-keys-vllnt.git
cd api-keys-vllnt
git checkout de026b054d4286092b16f7961271a301469990c3
```

## Before using this component

Read the package README at the recorded revision for setup, dependencies, and API examples. Upstream documentation describes the original package and may differ from the Bijection adaptation. This is a source candidate for evaluation. Catalog inclusion does not establish npm availability or runtime qualification. Check compatibility with your SDK and deployment before adoption. External providers run their own compute.

## Integration workflow

1. Read the source README and package manifest at the recorded revision.
2. Confirm the required SDK, dependency availability, and runtime compatibility.
3. Follow the component's documented setup and configuration. Never invent an npm install command from a catalog package name.
4. Keep credentials in the project's existing secret store.
5. Follow the project's execution rules for verification and report what was actually checked.

## Original upstream skill

The following guidance describes @vllnt/convex-api-keys. Its installation commands and APIs refer to the upstream package. Evaluate compatibility with the Bijection source separately.


> Agents: read this skill fully before writing code that uses API Keys. Follow the installation and configuration steps exactly.

# API Keys

## Instructions

@vllnt/convex-api-keys manages the lifecycle of credentials your application issues to API consumers. Store hashed keys, associate them with a trusted owner, and validate usage through your backend.

Create keys, validate them, list owner-specific metadata, and read usage counts. Disable and enable offer a reversible pause; revoke ends access. Rotation allows a configured overlap period. Tags, environments, and finite-use counters support host-defined credential policies.

The host authenticates administrators, derives ownerId from trusted identity, and enforces endpoint permissions. An ownerId comparison is not proof of identity by itself. Keep secret keys out of logs and client bundles; publishable keys are identifiers, not authorization secrets.

Maintained by [bntvllnt](https://bntvllnt.com) at [VLLNT](https://vllnt.com). Find the author on [GitHub](https://github.com/bntvllnt) and [X](https://x.com/bntvllnt).

### Installation

```bash
npm install @vllnt/convex-api-keys
```

Current npm version: `@vllnt/convex-api-keys@0.2.0`

## Use cases

- Developer products: let customers create and revoke keys for their integrations.
- Internal tooling: provision credentials for CLI clients or scheduled jobs.
- AI agent tools: issue a separate credential per authorized integration and enforce its permissions in your host.
- Support and operations: pause a key or rotate it with a grace period while a client updates its configuration.

## How it works

Create keys, validate them, list owner-specific metadata, and read usage counts. Disable and enable offer a reversible pause; revoke ends access. Rotation allows a configured overlap period. Tags, environments, and finite-use counters support host-defined credential policies.

The host authenticates administrators, derives ownerId from trusted identity, and enforces endpoint permissions. An ownerId comparison is not proof of identity by itself. Keep secret keys out of logs and client bundles; publishable keys are identifiers, not authorization secrets.

## When NOT to use

- When a simpler built-in solution exists for your specific use case
- If you are not using Convex as your backend
- When the functionality provided by API Keys is not needed

## Resources

- [npm package](https://www.npmjs.com/package/%40vllnt%2Fconvex-api-keys)
- [GitHub repository](https://github.com/vllnt/convex-api-keys)
- [Live demo](https://vllnt.com)
- [Convex Components Directory](https://www.convex.dev/components/vllnt/convex-api-keys)
- [Convex documentation](https://docs.convex.dev)