Skip to main content
POST
Related guide: API keys guide. See the API keys guide for a walkthrough with examples.

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
​
name
string
required

Display name of the key.

Maximum string length: 100
​
access
object

Per-domain access level (none, read or write) for restricted keys; domain ids come from the capability catalog.

​
constraints
object

Expiry and other limits applied to the key.

​
expiration
string<date-time>

Legacy expiry as an RFC 3339 timestamp; prefer constraints.expires_at.

​
owner
object

Lifecycle binding: a user-owned key is revoked with the user, a service-account key outlives any user.

​
permission_mode
enum<string>

Permission preset; restricted keys hold only the domains granted in access.

Available options:
all,
restricted,
read_only,
PERMISSION_MODE_ALL,
PERMISSION_MODE_RESTRICTED,
PERMISSION_MODE_READ_ONLY
​
project_scope
object

Projects the key may reach: every project of the workspace or a single one.

​
projects
string[] | null

Legacy single-project binding; prefer project_scope.

Maximum array length: 1

Response

API key created successfully.

​
id
string
required
​
name
string
required
​
workspace_id
string
required
​
token
string
required

Raw on create; the key prefix on retrieve and update; masked in list responses.

​
active
boolean
​
is_legacy
boolean
​
source
string
​
budget
object
​
expiration
string<date-time>
​
projects
string[]
​
created_by_id
string | null
​
updated_by_id
string | null
​
created
string<date-time>
​
updated
string<date-time>
​
consumption
number
​
token_consumption
number
​
requests_per_minute_consumption
number
​
owner
object
​
project_scope
object
​
permission_mode
string
​
access
object
​
token_prefix
string
​
status
string
​
constraints
object
​
mcp_access
object
​
legacy_token_family
string
​
legacy_key_id
string
​
last_used_at
string<date-time>