ONonkernel
API Keys

Create an API key

Changed on

Create a new API key. API keys may be scoped by project and may include a policy.

post/org/api_keys

Request

  • Base URL
    https://api.onkernel.com
  • URL
    https://api.onkernel.com/org/api_keys
  • Auth
    HTTP bearer

Request body

days_to_expireinteger nullable

Number of days until expiry, up to 3650. Use null for never. Cannot be combined with expires_at.

expires_atstring date-time nullable

Exact expiry time. Must be in the future and no later than the issuing credential's own expiry. Cannot be combined with days_to_expire.

namestring required

Label for the API key (1-255 characters). API keys are not addressable by name.

project_idstring nullable

Unique project identifier

Example request

{
  "days_to_expire": 30,
  "expires_at": "2025-01-15T09:00:00Z",
  "name": "staging",
  "policy": {
    "statements": [
      {
        "action": "browsers:use",
        "resource": "projects/proj_abc123/browsers/br_abc123"
      }
    ]
  },
  "project_id": "proj_abc123"
}

Response

API key created successfully

created_atstring date-time required

When the API key was created

deleted_atstring date-time nullable required

When the API key was deleted (soft-deleted). Null for keys that have not been deleted.

expires_atstring date-time nullable required

When the API key expires

idstring required

Unique API key identifier

last_used_atstring date-time nullable required

When the API key last authenticated a request, accurate to within about 20 minutes. Null if the key has not been used since last-use tracking began.

masked_keystring required

Masked version of the API key

namestring required

Label for the API key. API keys are not addressable by name; use the ID or key identifier for stable references.

project_idstring nullable required

Project identifier for project-scoped API keys. Null means org-wide.

project_namestring nullable required

Project name for project-scoped API keys. Null means the key is org-wide or the project name is unavailable.

keystring required

Plaintext API key. Only returned once when the key is created.

Example response

{
  "created_by": {
    "email": "user@example.com",
    "id": "user-abc123",
    "name": "Jane Doe"
  },
  "id": "ckv9w8q2f000001l5r3j7k9m4",
  "masked_key": "sk_1234...abcd",
  "name": "production",
  "policy": {
    "statements": [
      {
        "action": "browsers:use",
        "resource": "projects/proj_abc123/browsers/br_abc123"
      }
    ]
  },
  "project_id": "proj_abc123",
  "project_name": "Production",
  "key": "sk_1234abcd"
}

Changes

  • 1323a8a9aefbRevision changes
    • info

      added the required property //// to the response with the status

  • bb77c8264087Revision changes
    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the non-success response with the status

    • info

      added the optional property //// to the response with the status