OPopenmercantil
User
API Credentials

Create an API credential

Changed on

Creates a credential once and returns the full token on the original response or an identical Idempotency-Key retry within 24 hours. Requires session cookie, X-CSRF-Token, a durable users.sqlite idempotency schema and configured credential/idempotency key material. List/get never expose the token.

post/api/v1/user/api-credentials

Request

Headers

X-CSRF-Tokenstring required

Fresh token returned by GET /api/v1/user/me for this authenticated session.

Idempotency-Keystring required

Required for account mutations that reveal a secret. Reuse the same key only for an identical payload. The encrypted response can be replayed for 24 hours; a changed payload or an expired key returns 409.

Request body

namestring
scopesstring[] required
expires_atstring date-time nullable

Default 90 days; maximum 366 days.

Response

Credential created, or its encrypted one-time response replayed for the same key and payload

oktrue required
tokenstring required

Visible only in the original create/rotate response and identical Idempotency-Key replays during the 24-hour recovery window; never recoverable through list/get.

token_visible_oncetrue required
replaced_credential_idinteger
idempotency_replayedboolean required
idempotency_expires_atinteger required

Unix timestamp for the encrypted replay window.

Changes