Keys

Create an API key

Mints a key and returns its raw token EXACTLY ONCE. The requested scopes must be a subset of the authenticating key's scopes (else 403 scope_escalation), and a single-site key may only create keys locked to its own site (else 403 key_not_scoped). expires_in_days defaults to 90 and is capped at 365 — unlike the dashboard, the API cannot mint a key that never expires. Max 10 active keys per account.

post/keys

Request

Base URL
https://statable.com/api/v1
Auth
HTTP bearer
TypeScript
https://skmtc.dev/statable/apis/statable-stats-api/docs/keys/post.ts
A function with typed inputs. Its response is checked against the schema.

Request body

namestring required

scopesstring[]

Defaults to ["read"]. Must be a subset of the authenticating key's scopes, else 403 scope_escalation.

website_idinteger nullable

Lock the new key to one site. Omit/null = all of the owner's sites. A single-site key MUST pass its own site id here.

expires_in_daysinteger

Outside 1–365 → 400 invalid_expiry.

Response

The created key, including the one-time raw token.

idinteger required

namestring required

prefixstring required

Non-secret fragment of the token, to identify the key in a list.

website_idinteger nullable required

The site the key is locked to; null = all of the owner's sites.

scopesstring required

Comma-separated scope set, in catalog order.

created_atstring date-time required

created_ipstring nullable

last_used_atstring date-time nullable

last_used_ipstring nullable

expires_atstring date-time nullable

null = never expires. Only dashboard-created keys can be non-expiring; keys created over the API always carry an expiry.

tokenstring required

The raw bearer token. Store it now.

Example response

{
  "prefix": "stbl_A1b2C3d4",
  "scopes": "read",
  "token": "stbl_Z9y8X7w6…"
}

Changes

No recorded changes to this operation across all 1 revision of this API.