UNunkeyed
rootKeys

Create root key

Changed on

Creates a root key for the authenticated workspace. Requires unkey:v1:<workspace_id>:rootKeys/*#write. The created root key cannot have more permissions than the caller.

post/v2/rootKeys.createKey

Request

  • Base URL
    https://api.unkey.com
  • URL
    https://api.unkey.com/v2/rootKeys.createKey
  • Auth
    HTTP bearer

Request body

ipAllowliststring[]

IPv4 or IPv6 addresses and CIDR ranges allowed to use this root key. Omit to inherit the calling root key's allowlist. A caller without an IP restriction creates an unrestricted key when this field is omitted. An explicit list must stay within the caller's allowed networks; a restricted caller cannot send an empty list.

namestring

Optional name for the root key.

permissionsstring[] required

Permissions to grant to the root key. Each permission must be within the caller's existing permissions.

expiresinteger nullable

Expiration as Unix milliseconds, strictly in the future. Expiring root-key callers must provide a child expiry no later than their own. JWT admins and nonexpiring root-key callers may omit it or set null for no expiration.

Response

Root key created. Save the secret now; it cannot be retrieved later.

Example response

{
  "meta": {
    "requestId": "req_123"
  }
}

Changes