Create a backend secret, returned only once
Responses use Cache-Control: no-store. Application management requires the personal owner or workspace owner/admin. Existing application identities and credentials are preserved. Character playback issuance has been retired; use a backend REST key to retrieve signed canvas release delivery.
Select Masko-API-Version: 2026-09-26 (or api_version=2026-09-26) for the canonical mascot contract shown first. Existing unversioned clients keep legacy collection fields. A mascot_id query filter also selects the canonical contract. Mixing identifier names returns 400.
Request
- Base URL: https://api.masko.ai
- URL: https://api.masko.ai/v1/applications/{id}/keys
- Auth: HTTP bearer
Path parameters
Query parameters
Equivalent to the version header, for polling URLs and clients that accept only relative paths. Header and query must agree.
Headers
Account-scoped key (1 to 255 characters, ideally a UUID). Retries must preserve the credential workspace, effective API version, URL, content type and exact body bytes, including multipart boundaries; different inputs return 409 idempotency_key_reused. Completed responses, including 500 errors, replay for 24 hours after completion with current resource access checked again. Running or unconfirmed executions return 409 idempotency_request_in_progress and do not expire automatically. A receipt persistence failure returns 503 idempotency_persistence_failed: retry only with the same key and inspect the operation outcome before starting a new request.
Use 2026-09-26 for mascot_id resource fields. Unversioned shared routes retain the legacy contract.
Request body
Response
Success