Skip to main content
POST
Create a personal API key
A signed-in human session with recent authentication is required. Complete password/passkey reauthentication when requested. Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority. Request conventions · API keys · MCP connections

Authorizations

posted_session
string
cookie
required

Signed-in human browser session; mutation requests also need the exact UI Origin

Headers

Origin
string<uri>
required

The exact configured Posted UI origin. Required for browser mutations carrying session cookies.

Body

application/json
name
string
required
Required string length: 1 - 120
access
enum<string>
required
Available options:
read,
edit
includeAdmin
boolean
required
expiresAt
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$

Response

Successful response. Examples are illustrative; field values vary by record.

credential
object
token
string