Developers
Build on Passkey-X
REST APIs, an official SDK, command-line tools, signed webhooks, SCIM and audit streaming: everything you need to connect Passkey-X to your apps, scripts, CI pipelines and security tools, without ever handling plaintext secrets.
- Endpoints
- 95 across 3 APIs
- Organization API
- 1.8
- Webhook events
- 122
- SDK · CLI
- 1.1.0 · 0.1.0
- Base URL
https://passkey-x.com/api
Quick start
- Check the API is reachable. No key needed.
Request curl -s https://passkey-x.com/api/v1/health # → {"status":"ok"} - Create a key. A personal key (
pxu_…) in Passkey-X → Developers → API keys for your own data, or an organization key (pxk_…) in Admin console → Integrations → API keys. See Authentication. - Make your first call with the SDK (or cURL from the REST API page).
JavaScript / TypeScript import { PasskeyX } from "@passkey-x/sdk"; const px = new PasskeyX({ apiKey: process.env.PASSKEY_X_API_KEY }); // pxu_… from the API keys tab const me = await px.me(); console.log(me.key?.name, me.key?.scopes, me.your_ip); const vaults = await px.workspaces.list();
Documentation
Start
REST APIThree REST APIs (Customer, Organization and Agent) with 95 documented endpoints, one error format and one zero-knowledge boundary.AuthenticationPersonal keys (pxu_), organization keys (pxk_), agent tokens (pxa1.) and SCIM tokens: scopes, expiry, IP allowlists and one-hour test keys.ChangelogWhat changed in the APIs, the webhook event catalog and the SDK, newest first.
Conventions
HTTP headersEvery request and response header the APIs read or send through passkey-x.com/api, and the headers on webhook deliveries.ErrorsOne error shape for every API, every error code by HTTP status, and what to do about each.Pagination and rate limitsCursor pages, the Link header, the change feed, and the rate limits of each API with their RateLimit-* headers.Idempotency and concurrencyRetry writes safely with Idempotency-Key, and never overwrite someone else's change with ETag and If-Match.
Build
WebhooksSigned, ordered, at-least-once deliveries: the event catalog, payload, signature verification, retries, dead letters, replay and secret rotation.JavaScript SDKThe official SDK: one client for every API with retries, pagination, typed errors, idempotency and webhook verification. Zero dependencies.
Organizations
Tools
Command linepasskey-x for the API, agents and self-hosted servers, and pkx for secrets from the desktop app in your scripts.Agents for CIGive scripts, CI pipelines and AI agents the secrets they need from vaults shared with them, decrypted on their own machine.OpenAPI and PostmanDownload the OpenAPI 3.1 file, the Postman collection and environment, and the SDK kit files.
Deployment
Rolling Passkey-X out to a company, or running it yourself? These pages cover installation and managed settings.
Self-hostingRun Passkey-X on your own servers; the SDK and CLI take your own /api as their base URL.Apps and managed deploymentDesktop, mobile and the browser extension, with managed settings for your device management tool.ControllerManage company computers; queue scans, locks and updates from your RMM with the Organization API.Desktop Micro AgentThe small background agent for company computers.
Step-by-step guides
- Connect single sign-on (SAML) and SCIM provisioningLet people sign in with Okta, Microsoft Entra ID or Google, and add or remove them automatically.
- Use the Passkey-X API with a personal API keyCreate a scoped, expiring key with an IP allowlist, try it in the console, then use it in Postman or your script.
- Connect HR, SIEM and ticketing tools with the Organization APIAutomate onboarding, offboarding, alerts and reports with scoped API keys.
- Give scripts and CI pipelines access with agentsAgents read only the vaults you share with them and decrypt on their own machine.
- Stream audit events to Splunk, Datadog, Sentinel or ElasticSend every audit event to your security tools as it happens.
Need help building on Passkey-X?
Questions about the API, a bug or a missing endpoint? Our team replies by email, usually within one business day.