Create API key

Create a new API key.

Returns the full API key exactly once. The key cannot be retrieved after this response - only the masked key_prefix is stored.

Scopes are validated against the creating user's permissions. You cannot grant scopes you don't have.

RLS: Filtered to current client (ClientRLSDB).

Raises: ApiKeyScopeExceededError: If requested scopes exceed user's permissions (403)

Request body

descriptionstring nullable

Optional description

expires_atstring date-time nullable

Optional expiration datetime (UTC)

namestring required

Name for the API key

scopesstring[] required

List of scopes to grant to this key

Successful Response

created_atstring date-time required

Creation timestamp

expires_atstring date-time nullable required

Expiration datetime

idstring uuid required

API key UUID

keystring required

Full API key (only shown once)

namestring required

API key name

scopesstring[] required

Granted scopes