Skip to main content
POST
Create a team API key
A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication. Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority. Request conventions · API keys · MCP connections

Authorizations

posted_session
string
cookie
required

Signed-in human browser session; mutation requests also need the exact UI Origin

Headers

Origin
string<uri>
required

The exact configured Posted UI origin. Required for browser mutations carrying session cookies.

Body

application/json
name
string
required
Required string length: 1 - 120
access
enum<string>
required
Available options:
read,
edit
includeAdmin
boolean
required
expiresAt
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$

Response

Successful response. Examples are illustrative; field values vary by record.

credential
object
token
string