The key secret is returned once, in this response only — it cannot be retrieved again.

ATTENUATION: the optional scopes, scoped_workspace_ids, scoped_namespaces and expires_at must each be within the MINTING credential's own effective authority (scopes ⊆, workspaces ⊆, namespaces ⊆, expiry ≤), and within the minter's role permissions. A credential can never mint a stronger credential, so a machine key that can mint keys is safe: it can only ever mint weaker ones. Wildcards (*, memories:*, *:read) are accepted and stored FROZEN — the literal plus its expansion as of today — so a stored * is never widened by a resource added later; re-mint to pick new resources up.

Omitting every scoping field reproduces the pre-scoping behavior: on the session lane no scope record is written and the key resolves to LEGACY_DEFAULT; on the machine lanes the new key INHERITS the minter's own authority (never LEGACY_DEFAULT, which could be broader).

scoped_namespaces restricts the key to a set of namespaces (null or omitted inherits the minter's, which for an unrestricted minter is unrestricted; an empty array is REJECTED rather than read as unrestricted). An unrestricted minter may grant any set; a restricted one may only narrow. A namespace-restricted key is /v2-only — the /v1/* and /mcp passthrough denies it with 403, because the gateway does not parse those bodies and Kairos has no per-credential namespace scope, so the restriction would be bypassable by changing the URL prefix.

Requires the keys:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying keys:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include keys:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).