Skip to main content
POST
Create a new management key

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
name
string
required

Human-readable name. Required.

permission_mode
enum<string>

Permission preset. Defaults to MANAGEMENT_PERMISSION_MODE_ALL when omitted.

Available options:
MANAGEMENT_PERMISSION_MODE_UNSPECIFIED,
MANAGEMENT_PERMISSION_MODE_ALL,
MANAGEMENT_PERMISSION_MODE_RESTRICTED,
MANAGEMENT_PERMISSION_MODE_READ_ONLY
access
object

Per-domain access map. Required when permission_mode = MANAGEMENT_PERMISSION_MODE_RESTRICTED. See ManagementKey.access for the catalog of valid keys (Domain.id) and AccessLevel string values, or fetch the live catalog via the capability catalog endpoint.

expires_at
string<date-time>

Optional expiration. When set, the authenticate hot-path rejects the key once expires_at is in the past. Unset means the key never expires.

Response

200 - application/json

OK

management_key
object
required

Newly minted management-key record.

token
string
required

Raw bearer token in the form sk-orq-<management_key_id>-<secret>. Returned ONCE; the API never exposes this value again.