Skip to main content
POST
Create API Key

Authorizations

Authorization
string
header
required

API key or JWT token

Body

application/json
expirySeconds
integer

Optional TTL in seconds. Omit for a non-expiring key; short-lived keys are recommended for per-session embedding flows.

Example:

3600

assumedRoles
string[]

Role UUIDs to scope the key to. Callers may only specify roles they hold; API-key callers may only specify a subset of their own assumed roles.

Example:
inheritAllRoles
boolean

Set to true to inherit all of the creating member's roles. Required when assumedRoles is empty.

name
string

Optional display name for the key.

Example:

"acme-session-key"

targetMemberId
string

Mint the key for this member instead of the caller. Requires organization:write and a service-account target.

clientId
string

Optional client metadata stored on the key. Prefer a JSON object string (a JSON-encoded string, not a nested object); TQL row-level security reads its fields as _tql.client_attributes_json.<field>.

Example:

"{\"tenant_id\": \"acme\", \"user_email\": \"jane@acme.example\"}"

Response

The created key. key is the bearer secret, shown only once.

key
string

The full bearer credential. Shown exactly once; store it securely. Use as Authorization: Bearer <key>.

Example:

"BEARER_SECRET_SHOWN_ONCE"

api_key
object