Skip to main content
POST
Create an API key for a service account

Authorizations

Authorization
string
header
required

JWT Bearer token authentication. Include your access token in the Authorization header as: Bearer YOUR_ACCESS_TOKEN

Example:

Path Parameters

service_account_id
string<uuid>
required

UUID of the service account to create an API key for

Body

application/json

Public API request payload for creating a new API key.

name
string
required

Human-readable name for this API key.

Maximum string length: 255
Example:

"API Key"

description
string | null

Optional description explaining the purpose and usage of this API key.

Example:

"API key for external integrations"

scopes
enum<string>[] | null

Surfaces this API key may call. 'mcp' allows the MCP server at /mcp/v2; 'api' allows the REST API. The legacy MCP server at /mcp exposes REST operations as tools, so it needs both. NULL (the default) allows every surface. A call outside the key's scopes gets 403 with error code 'api_key_scope': an MCP-only key (['mcp']) on any REST path or on /mcp. Allowed values: 'mcp', 'api'. Omit for every surface; an empty list is rejected. Scopes cannot be changed after creation.

Minimum array length: 1

A surface an API key may call.

Available options:
mcp,
api
Example:

Response

API key created successfully

Response model for API key creation including the full token.

created_at
string<date-time>
required
id
string<uuid>
required
modified_by
string
required
name
string
required
organization_id
string<uuid>
required
token
string
required

Full authentication token. This is the only time the full token is shown. Store it securely as it cannot be retrieved later.

Example:

"saf_org_550e8400_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz"

token_prefix
string
required
updated_at
string<date-time>
required
description
string | null
scopes
enum<string>[] | null

Surfaces this API key may call. 'mcp' allows the MCP server at /mcp/v2; 'api' allows the REST API. The legacy MCP server at /mcp exposes REST operations as tools, so it needs both. NULL (the default) allows every surface. A call outside the key's scopes gets 403 with error code 'api_key_scope': an MCP-only key (['mcp']) on any REST path or on /mcp.

A surface an API key may call.

Available options:
mcp,
api
Example:
service_account_id
string<uuid> | null
user_id
string<uuid> | null