GEgetsales
api_keys

Create API key

Mint an API key and return the secret beside the item as the envelope's plaintext_token EXACTLY ONCE: hand it to the user at once, never log or echo it; if lost, rotate. permissions must sit inside the issuer's own grant (403 grant_exceeds_ceiling; * only from an unrestricted issuer). expires_at omitted = three years, null = perpetual. Natural key (team, name) among live keys (an expired or revoked key frees its name): a duplicate answers already_exists with the existing key and NO secret.

Contract:

  • MCP tool create_api_key, registry package mcp.id/api_keys, mount id.access.
  • Operation create, response envelope create.
  • Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
post/api/api-keys

Request

  • Base URL
    https://beta.getsales.io/id/v1
  • Auth
    HTTP bearer and API key in header Team-SID

Request body

namestring required

Human-readable key name; unique among the team's live keys.

permissionsstring[] required

The explicit token list the key gets; inside the issuer's own grant.

account_sidsstring[] nullable

The sender identities the key may act on (ln_ac_...), inside the issuer's own slice; omitted or null = the issuer's whole slice.

expires_atstring nullable

ISO 8601 UTC; omit = now plus three years; null = perpetual.

Response

create success envelope.

successtrue required
operation'create' required
already_existsboolean required
plaintext_tokenstring

The full secret, shown ONCE on a real mint; absent when already_exists is true.

Changes

No recorded changes to this operation across all 1 revision of this API.