Create an API key

Creates a scoped API key and returns the secret exactly once — it is never readable again. Store it before closing the response; if it is lost, revoke the key and create another.

scopes is required and cannot be empty: a key with no scope reaches nothing. Pass exactly ["*"] for full access, which also covers scopes added in the future. resources is optional and restricts the key to specific applications/databases — every id must belong to the account, and it is immutable: deleting an application does not remove its id from an existing key (an empty resources means whole account, so pruning it would silently promote the key).

resources cannot be combined with blob:read/blob:write, nor with ["*"] (CONFLICTING_RESOURCES). Object storage belongs to the account and no object carries an application id, so the restriction has nothing to apply to there — a key holding both would have to ignore one half or the other. Use one key for the applications and another for object storage.

Manually created keys never expire. Keys issued through the client-authorization flow expire in 90 days.

Session token only — an API key cannot create API keys.