Skip to main content
POST
Create API key

Authorizations

Authorization
string
header
required

Bearer token authentication via Auth0. Users authenticate through Auth0 Universal Login. Include the access token in the Authorization header: Authorization: Bearer <token>

Path Parameters

workspaceId
string
required

The workspace ID

Pattern: ^ws_[a-z0-9]+$

Body

application/json
name
string
required
Required string length: 1 - 255
permissions
string[]
expires_at
string<date-time> | null
brand_id
string<uuid> | null

Phase 176-05: brand-scoped key. When set, this key can only access products and resources belonging to the specified brand. Omit or set to null for workspace-wide access.

Response

API key created successfully

id
string
required
workspace_id
string
required
name
string
required
key_prefix
string
required

First 10 characters of the API key

created_at
string<date-time>
required
permissions
string[]
last_used_at
string<date-time> | null
expires_at
string<date-time> | null
created_by
string
brand_id
string<uuid> | null

Phase 176-05: brand scope. Non-null means this key is restricted to resources of the specified brand.

secret
string

Full API key (only shown on creation)

Last modified on February 16, 2026