Create an API key
Create a new API key. To prevent privilege escalation, the new key’s scopes must be a subset of the calling key’s scopes, and package_ids (if provided) must be a subset of the calling key’s package restriction. If package_ids is omitted, the new key inherits the calling key’s restriction.
The response includes the plaintext secret — this is the only time it is ever returned. Store it immediately in a secure location.
Requires the api-keys:write scope.
Authorizations
API key secret (starts with s_live_). Create keys in the dashboard under Settings → API keys, or via POST /v1/api-keys/. Send it as Authorization: Bearer <secret>.
Body
Request schema for POST /v1/api-keys endpoint.
Human-readable name for the key (shown in the dashboard and key listings).
Scopes to grant. Must be a subset of the calling key's own scopes.
Optional list of package IDs the key is restricted to. Must be a subset of the calling key's own restriction. Omit to inherit the calling key's restriction; null on an unrestricted caller creates an unrestricted key.
Response
Successful Response
Response schema for POST /v1/api-keys endpoint.
Includes the plaintext secret, which is only revealed at creation time and can never be retrieved again. The secret should be immediately stored by the client in a secure location.