v1

latestOpenAPI 3.0.32026-07-17183583.3 KB

ApiKeys

Issue API Key

Creates a new API key for a given actor. The secret is returned only once in the response and cannot be retrieved later. Keys can be scoped with specific permissions and have optional expiration.

POST /v2alpha1/admin/issuedApiKeys
{
  "name": "production-service",
  "actor_id": "user_123",
  "scopes": ["read", "write"],
  "ttl": "8760h"
}

post/v2alpha1/admin/issuedApiKeys

Request body

actor_idstring

metadataobject

metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field.

namestring

request_idstring

scopesstring[]

ttlstring

ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in "s", e.g. "3600s"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings ("24h", "30m", "1h30m") and an extended unit set ("1d", "1w", "1mo", "1y"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability.

visibility'KEY_VISIBILITY_UNSPECIFIED' | 'KEY_VISIBILITY_SECRET' | 'KEY_VISIBILITY_PUBLIC'

KeyVisibility distinguishes public (client-safe) keys from secret (server-only) keys. Public keys use a different configurable prefix for visual distinction. Both types share the same scope/permission system — visibility is about exposure safety.

KEY_VISIBILITY_UNSPECIFIED: Treated as SECRET

Response

A successful response.

secretstring