Account

Create an API key

Creates an API key with a finite scope and permission set. The policy cannot exceed the caller's current access. A device-login credential without standing key-mint access must send Idempotency-Key. The server then returns a browser approval step. After approval, send the same request body and Idempotency-Key with X-Spacefast-Continuation-Token. The response returns the full secret one time.

post/v1/api-keys

Request

  • Base URL: https://api.spacefast.com
  • URL: https://api.spacefast.com/v1/api-keys
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL https://api.spacefast.com/v1/auth/oauth2/authorize, token URL https://api.spacefast.com/v1/auth/oauth2/token; client credentials, token URL https://api.spacefast.com/v1/auth/oauth2/token, scopes: teams:create)

Headers

Idempotency-Keystring

Required for the browser approval flow. Optional for a credential that has tokens:create. Use a client-generated key of at most 255 characters. The first request with a given key stores its outcome, scoped to your tenant, credential, and route. A retry with the same key and an identical body does not execute again: the server replays the stored response and marks it Idempotency-Replayed: true. A request that reuses a key with a different body fails with 409 idempotency_key_reused. A duplicate request that arrives while the first is still in flight fails with 409 idempotency_conflict_in_progress. The server keeps each key for 24 hours.

X-Spacefast-Continuation-Tokenstring

Continuation token from an approved confirmation_required response. Send it only with the same request body and Idempotency-Key.

Request body

namestring

Human-readable key name.

permissionsstring[] required

Finite permission set the derived policy grants, and nothing beyond it.

metadataobject

Caller-supplied metadata.

ipAllowliststring[] nullable

CIDR/IP allowlist for the new key.

Response

Response for status 201

$schemastring uri

Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

Changes

No recorded changes to this operation across all 1 revision of this API.