---
title: "Mint one key per workspace role at the service and vault each [admin, owner or admin]"
method: POST
path: "/workspace-connectors/{id}/provision"
tags: ["workspace-connectors"]
---

# Mint one key per workspace role at the service and vault each \[admin, owner or admin\]

`POST /workspace-connectors/{id}/provision`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/workspace-connectors/{id}/provision`
- Auth: HTTP bearer

Through the service's own key route (POST {origin}/v1/keys) with the workspace's admin key, read from the named vault by the platform alone. Each key goes into a vault <kind>-<role> as <KIND>_API_KEY bound to the connector's host, which the connector then names for that role; a role that already had a key gets a new one, its secret is rotated in place so attached sessions follow, and the old key is revoked at the service. Behind CONNECTOR_KEY_MINTING (403 not_enabled otherwise). 404 unknown connector or admin vault, 422 admin_key_missing, 502 service_refused.

## Path parameters

- `id` string, required

## Request body

- ProvisionWorkspaceConnector
  - `admin_vault` string, required: The vault (vlt_…) holding the service's admin key; read by the platform alone
  - `admin_secret_name` string: The secret that is the admin key: an environment_variable secret by variable name, or a static_bearer secret by display name; default CRM_ADMIN_KEY
  - `roles` object, required: Per workspace role: the role the service gives the key, in the service's own vocabulary
    - `owner` object
      - `role` string, required
      - `see_money` boolean
      - `tools` string[]
    - `admin` object
      - `role` string, required
      - `see_money` boolean
      - `tools` string[]
    - `member` object
      - `role` string, required
      - `see_money` boolean
      - `tools` string[]
  - `deliver_as` 'env' | 'mcp_bearer': env (default): <KIND>_API_KEY bound to the origin's host; mcp_bearer: a bearer for the service's MCP server at origin + mcp_path
  - `mcp_path` string: Default /mcp

## Response `201`

Created

- ProvisionedConnectorKeys
  - `connector_id` string, required
  - `minted` object, required: Per workspace role: the key's id and prefix at the service, when it was minted, and the vault and secret name that carry it; never the key
  - `not_revoked` object[], required: Earlier keys the service would not revoke; revoke them by hand
    - `role` string
    - `key_id` string

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/workspace-connectors/:id/provision/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/8280a065ef6a?raw)