Tolgee Octri Demo
POST/v2/api-keys

Create an API key

Creates an API key for a project with the supplied permission scopes. Set projectId and scopes; optionally provide a description and expiration timestamp, with a null expiresAt meaning the key does not expire.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

4 body fields

API key details. projectId and scopes are required.

descriptionstringoptional
Description of the project API key
expiresAtintegeroptional
Expiration date in epoch format (milliseconds). When null key never expires.
projectIdintegerrequired
The project identifier. Must be at least 1.
scopesarray<string>required
The permission scopes to grant to the API key. Scope values must be unique.

5 status codes
200Returns the created API key details, including its key value, identifier, project information, scopes, and any expiration time.
descriptionstringrequired
expiresAtintegeroptional
idintegerrequired
keystringrequired
Resulting user's api key
lastUsedAtintegeroptional
projectIdintegerrequired
projectNamestringrequired
scopesarray<string>required
userFullNamestringoptional
usernamestringoptional
400Returned when required fields are missing or a request value fails validation.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
401Returned when the request is not authenticated.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
403Returned when the authenticated user is not permitted to create an API key for the project.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
404Returned when the specified project cannot be found.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional

Error handling

A 400 is returned when required fields are missing or a value fails validation. A 401 is returned when authentication is missing or invalid, a 403 when the authenticated user lacks permission, and a 404 when the project cannot be found. projectId must be at least 1, and scopes must contain unique scope strings.