customers

Create a customer API key (by external customer id)

Creates an API key bound to this customer. The response carries the secret in key, returned only this once: store it immediately, as Paid keeps only its hash. The key acts for this customer alone: it can send signals for this customer through POST /api/v2/signals/bulk, and every other route refuses it. Requires write:api-keys, which full-access keys hold; a restricted key needs the scope granted explicitly. Addresses the customer by your external customer id.

post/customers/external/{externalId}/api-keys

Request

  • Base URL: https://api.agentpaid.io/api/v2
  • URL: https://api.agentpaid.io/api/v2/customers/external/{externalId}/api-keys
  • Auth: HTTP bearer

Path parameters

externalIdstring required

Customer ID from your system, stored on Paid as the customer's externalId.

Request body

namestring required

A label for the key, shown in lists and in the audit log.

descriptionstring

Optional free text about where the key is used.

expiresAtstring date-time

Optional expiry (ISO 8601), which must be in the future. Without it the key works until it is revoked.

Response

201

idstring uuid required

The key's id.

namestring required
descriptionstring nullable required
customerIdstring nullable required

Display id (cus_…) of the customer the key acts for.

customerExternalIdstring nullable required

That customer's id in your system, if it has one.

scopesstring[] required

What the key may do.

keyPrefixstring required

The key's first characters, to recognise it in a list.

last4string required

The key's last four characters.

status'ACTIVE' | 'REVOKED' | 'EXPIRED' required

ACTIVE until the key is revoked (REVOKED) or its expiry passes (EXPIRED).

createdAtstring date-time required
lastUsedAtstring date-time nullable required
expiresAtstring date-time nullable required
revokedAtstring date-time nullable required
keystring required

The secret. Returned only in this response and never again: store it now. Paid keeps only its hash.

Changes

No recorded changes to this operation across all 1 revision of this API.