Create API key
POST
/v1/api-keys
Create a long-lived credential for a headless agent or MCP client that shouldn't hold an interactive login token. Send it as X-Api-Key (or Authorization: Bearer) on any request that needs auth. The raw secret is returned exactly once, in this response — store it now, because it can never be retrieved again. Requires an interactive login: an API key can't mint another key (403 interactive_auth_required) — create your first key in the web dashboard.
Authorizations
Bearer
JWT bearer token from POST /v1/auth/login.
Type
HTTP (bearer)
or
ApiKey
Scoped API key for non-interactive clients (issued by PBI #1426).
Type
API Key (header: X-Api-Key)
Request Body
application/json
One of
Request body for creating an API key (PBI #1426): a label, an optional set of ApiKeyScopes
(defaulting to read/write), and an optional lifetime in days (null = never expires).
How many days until the key expires; omit or leave null for a key that never expires.
Format
"int32"Pattern
"^-?(?:0|[1-9]\\d*)$"A label to recognize this key by (e.g. "CI pipeline").
The permissions to grant; omit for the default read/write scope.
Responses
Created
application/json
Success body for POST /api-keys: the newly-created key, with its raw secret shown
exactly once.
When the key was created.
Format
"date-time"When the key stops working, or null if it never expires.
Format
"date-time"Stable identifier for this key (used to revoke it later).
Format
"uuid"The caller-supplied label for this key.
The key's non-secret prefix, safe to display for recognition.
The permissions this key grants.
The raw key secret — shown here exactly once. Store it now; it can never be
retrieved again, only revoked and replaced.