API keys

Personal API keys let integrations act as you — every link they create lands in your dashboard, counts against your plan, and shows up in your analytics.

Create a key

1. Sign in and open Dashboard → Settings → API keys.
2. Give the key a name that says where it will live — Claude MCP, CI deploy script, ChatGPT Action.
3. Click Create key and copy the secret (slim_…) immediately.

The full secret is shown exactly once. After that the dashboard only shows the prefix (slim_b17f362…). If you lose it, revoke the key and create a new one.

Use a key

Send it as an X-API-Key header:

curl -s https://slim.to/api/v1/links -H "X-API-Key: slim_your_key_here"

Manage keys

• The settings page lists each key's name, prefix, creation date, and last used date — an easy way to spot dead keys.
• Revoke kills a key instantly; anything using it starts getting 401s on the next request.
• You can hold up to 10 active keys. Prefer one key per integration so you can revoke one without breaking the others.

Good hygiene

• Treat a key like a password: it can create, list, and delete your links and read your analytics.
• Put keys in environment variables or a secrets manager — never in committed code, chat messages, or shared documents.
• Keys can only be created or revoked from a signed-in session — a leaked key cannot mint more keys.
• Requests are rate-limited to 120/minute per key; a 429 response means back off for a minute.

API endpoints (for completeness)

Key management itself requires session (JWT) auth, not key auth: