Skip to main content
POST

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
name
string
required

Human-readable name. Required.

owner
object

Owner attribution. Defaults to service_account when omitted.

project_scope
object

Project authorization scope. Defaults to all-projects when omitted.

permission_mode
enum<string>

Permission preset. Defaults to PERMISSION_MODE_ALL when omitted.

Available options:
PERMISSION_MODE_UNSPECIFIED,
PERMISSION_MODE_ALL,
PERMISSION_MODE_RESTRICTED,
PERMISSION_MODE_READ_ONLY
access
object

Per-domain access map. Required when permission_mode = PERMISSION_MODE_RESTRICTED. See ApiKey.access for the full catalog of valid keys (Domain.id) and AccessLevel string values, or fetch the live catalog via the capability catalog endpoint.

expires_at
string<date-time>

Optional expiration. When set, the authenticate hot-path rejects the key once expires_at is in the past. Unset means the key never expires.

Response

200 - application/json

OK

api_key
object
required

Newly minted api-key record.

token
string
required

Raw bearer token in the form sk-orq-<api_key_id>-<secret>. Returned ONCE; the API never exposes this value again. Clients must persist it immediately on receipt.