Skip to main content
POST
Create a labeled API key

Authorizations

Authorization
string
header
required

A Cognito access token, issued through the dashboard's own sign-up and sign-in pages (a backend-for-frontend; there is no Cognito Hosted UI) and sent as Authorization: Bearer <jwt>. Dashboard operations require this scheme and cannot be called with an API key, with no exception. GET /v1/usage and GET /v1/limits offered both schemes from 0.8.0; 0.8.1 withdrew that, because the control-plane API serves them alone and its authorizer has no API-key branch. An account_id supplied by the client is ignored; all reads/writes are scoped server-side to the authenticated account.

Body

application/json
label
string
required
Required string length: 1 - 100
Pattern: ^[^\r\n]{1,100}$
mode
enum<string>
default:live
Available options:
live,
test

Response

The created key, including its one-time plaintext secret.

Same fields as ApiKeySummary plus the plaintext secret, shown exactly once. Duplicated rather than composed via allOf for the same reason documented on TranscriptArtifact.

key_id
string
required

Opaque, server-generated API key identifier.

Maximum string length: 40
Pattern: ^key_[A-Za-z0-9]{16,32}$
label
string
required
Required string length: 1 - 100
prefix
enum<string>
required
Available options:
hk_live_,
hk_test_
mode
enum<string>
required
Available options:
live,
test
created_at
string<date-time>
required
revoked
boolean
required
secret
string
required

The plaintext secret. Shown exactly once; never retrievable again.

Required string length: 20 - 200