[mintlify]

Documents regenerating personal API keys in the app and managing them with --personal in the CLI. This is GA: there's no flag, and it's in CLI v2.51.0 and live in prod per #changelog.

Based on feat: manage personal API keys with --personal, Add API endpoints for personal API keys and Add Regenerate for personal API keys.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
kosli	🟢 Ready	View Preview	Nov 2, 2026, 9:37 AM

[claude]

Claude finished @mintlify[bot]'s task in 1m 0s —— View job

---

Doc review: PR #484

I checked every CLI command and flag the new prose uses (--personal, --grace-period-hours, --description, --expires-at) against the generated pages in client_reference/kosli_*api-key*.md. They all exist and match. Every internal link and the new #rotate-a-key anchor resolve. Nothing in the repo links to the old #revoke-a-key anchor, and I found no other page still saying personal keys are "revoked".

user/personal_api_keys.md

• Improvement: user/personal_api_keys.md:65-68
  • Issue: the list of limits that apply when your --api-token is a personal key leaves one out. kosli rotate api-key says a key rotated this way also expires no later than the token key (client_reference/kosli_rotate_api-key.md:19-21). The --expires-at Warning in administration/authentication/api_key_rotation.md:21 mentions only the 365-day cap, so it has the same gap.
  • Recommendation: change the bullet to "create or rotate". Optionally add the same limit to the Warning. Suggested wording is in the inline comment.
  • Fix this →
• Suggestion: user/personal_api_keys.md:72
  • Issue: "Use the service account key commands for them" is ambiguous: "them" could mean personal keys or service accounts.
  • Recommendation: say that --personal rejects a service account key as --api-token, and to use --service-account for a service account's keys.

1 Improvement, 1 Suggestion, 0 Critical. This review is advisory, and neither finding blocks the merge.

[claude]

Improvement: this list leaves out a rotation limit. kosli rotate api-key (client_reference/kosli_rotate_api-key.md:19-21) says that when you use a personal key as --api-token, the rotated key also expires no later than that key. A reader who rotates with --expires-at set a year out would expect the full lifetime and not get it. The --expires-at Warning in api_key_rotation.md:21 mentions only the 365-day cap, so it has the same gap. A second detail: kosli delete api-key (:21) says deleting any key also deletes the keys created with it, not only when the key is your current token.

Suggested change

	When `--api-token` is itself a personal API key, these limits apply:
	- A key you create with it expires no later than that key, and is deleted along with it.
	- You can only rotate or delete that key and the keys created with it.
	When `--api-token` is itself a personal API key, these limits apply:
	- A key you create or rotate with it expires no later than that key, and is deleted along with it.
	- You can only rotate or delete that key and the keys created with it.

[claude]

Suggestion: "them" can be read two ways: personal keys, or service accounts. I think the intended meaning is that --personal rejects a service account key as --api-token. Saying that directly avoids the confusion:

Suggested change

	Service accounts can't manage personal API keys. Use the service account key commands for them.
	`--personal` doesn't accept a service account API key as `--api-token`. To manage a service account's keys, use `--service-account` instead.