v171

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-0726249111.7 MB

Management keys

Create a new management key

Mints a new opaque management key (sk-orq-<key_id>-<secret>) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only token_prefix and a SHA-256 token_hash.

post/v2/management-keys

Request body

namestring required

Human-readable name. Required.

permission_mode'MANAGEMENT_PERMISSION_MODE_UNSPECIFIED' | 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY'

accessobject

Per-domain access map. Required when permission_mode = MANAGEMENT_PERMISSION_MODE_RESTRICTED. See ManagementKey.access for the catalog of valid keys (Domain.id) and AccessLevel string values, or fetch the live catalog via the capability catalog endpoint.

expires_atstring date-time

Optional expiration. When set, the authenticate hot-path rejects the key once expires_at is in the past. Unset means the key never expires.

Response

tokenstring required

Raw bearer token in the form sk-orq-<management_key_id>-<secret>. Returned ONCE; the API never exposes this value again.