Skip to main content
POST
Create API Key

Authorizations

Authorization
string
header
required

API key or JWT token

Body

application/json
expirySeconds
integer

Optional TTL in seconds. Omit for a non-expiring key; short-lived keys are recommended for per-session embedding flows.

Example:

3600

assumedRoles
string[]

Role UUIDs to scope the key to. Callers may only specify roles they hold; API-key callers may only specify a subset of their own assumed roles.

Example:
inheritAllRoles
boolean

Set to true to inherit all of the creating member's roles. Required when assumedRoles is empty.

name
string

Optional display name for the key.

Example:

"acme-session-key"

targetMemberId
string

Mint the key for this member instead of the caller. Requires organization:write and a service-account target.

clientId
string

Optional client metadata stored on the key. Prefer a JSON object string (a JSON-encoded string, not a nested object); TQL row-level security reads its fields as _tql.client_attributes_json.<field>.

Example:

"{\"tenant_id\": \"acme\", \"user_email\": \"jane@acme.example\"}"

fullMemberAccess
boolean

When true, the key retains the target member's direct object grants alongside its assumed-role grants. API-key callers may enable this only when their own key already has full member access.

Response

The created key. key is the bearer secret, shown only once.

key
string

The full bearer credential. Shown exactly once; store it securely. Use as Authorization: Bearer <key>.

Example:

"BEARER_SECRET_SHOWN_ONCE"

api_key
object