Sign in
organization-keys

Create Own Key

Create an API key owned by the caller, in a workspace they may see.

The member-scoped counterpart of POST /v1/keys: the owner is always the caller's own attribution user, the key is always budget-enforced, and the workspace must be visible to the caller (a member of it, or an organization owner/admin/superuser, who see every workspace). The secret is returned once.

post/v1/organizations/me/keys

Request body

allowed_modelsstring[] nullable

Model allow-list: null = any model your user default allows, [] = deny all, or canonical instance:model entries. A key can only narrow your own model access, never broaden it.

capture_agent_telemetryboolean nullable

Per-key override of the deployment-wide capture_agent_telemetry setting: null (default) inherits it, true always stores this key's coding-agent telemetry, false always discards it.

expires_atstring date-time nullable

Optional expiration timestamp

key_namestring nullable

Optional name for the key

metadataobject

Optional metadata

reject_user_mismatchboolean nullable

Per-key override of the deployment-wide reject_user_mismatch setting: null (default) inherits it, true always rejects a request naming a different 'user', false always accepts it. Spend binds to your own user either way.

workspace_idstring uuid nullable

Workspace this key belongs to, which must be one you may see in your active organization. Omitted means that organization's default workspace, refused when you are not a member of it.

Response

Successful Response

allowed_modelsstring[] nullable required
capture_agent_telemetryboolean nullable required
created_atstring required
exclude_from_budgetboolean required
expires_atstring nullable required
idstring required
is_activeboolean required
keystring required
key_namestring nullable required
key_prefixstring nullable required
metadataobject required
reject_user_mismatchboolean nullable required
user_idstring nullable required

Changes