Skip to main content
POST
Mint an API key

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

Idempotency-Key
string

Client-generated idempotency key (≤255 chars). Replays the cached response when the same (team, key) pair sees an identical request body within 24h; returns 409 idempotency_key_reused if the body differs. Recommended for every billable POST.

Maximum string length: 255
Autousers-Version
string

Date-pinned API version (e.g. 2026-05-04). Omit to receive the latest stable version. Behaves like Stripe's Stripe-Version — pinning a version freezes payload shapes against breaking changes during the 12-month sunset window.

Body

application/json
name
string
required
Required string length: 1 - 100
scopes
enum<string>[]
required
Minimum array length: 1
Available options:
*,
templates:read,
templates:write,
templates:*,
evaluations:read,
evaluations:write,
evaluations:*,
autousers:read,
autousers:write,
autousers:*,
ratings:read,
ratings:write,
ratings:*,
webhooks:read,
webhooks:write,
webhooks:*,
events:read
expiresAt
string<date-time>

Response

Created

id
string
required
name
string
required
prefix
string
required
scopes
string[]
required
createdAt
string<date-time>
required
token
string
required

Plain-text bearer token. Returned exactly once on creation.

lastUsedAt
string<date-time> | null
revokedAt
string<date-time> | null
expiresAt
string<date-time> | null
{key}
any