ORory
ApiKeys

Issue API Key

Creates a new API key for a given actor. The secret is returned only once in the response and cannot be retrieved later. Keys can be scoped with specific permissions and have optional expiration.

POST /v2alpha1/admin/issuedApiKeys
{
  "name": "production-service",
  "actor_id": "user_123",
  "scopes": ["read", "write"],
  "ttl": "8760h"
}
post/v2alpha1/admin/issuedApiKeys

Request

  • Base URL
    https://your-project.projects.oryapis.com
  • URL
    https://your-project.projects.oryapis.com/v2alpha1/admin/issuedApiKeys
  • Auth
    none declared

Request body

actor_idstring
metadataobject

metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field.

namestring
request_idstring
scopesstring[]
ttlstring

ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in "s", e.g. "3600s"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings ("24h", "30m", "1h30m") and an extended unit set ("1d", "1w", "1mo", "1y"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability.

visibility'KEY_VISIBILITY_UNSPECIFIED' | 'KEY_VISIBILITY_SECRET' | 'KEY_VISIBILITY_PUBLIC'

KeyVisibility distinguishes public (client-safe) keys from secret (server-only) keys. Public keys use a different configurable prefix for visual distinction. Both types share the same scope/permission system — visibility is about exposure safety.

  • KEY_VISIBILITY_UNSPECIFIED: Treated as SECRET

Response

A successful response.

secretstring

Changes

No recorded changes to this operation across all 1 revision of this API.