This operation creates a new API key for a principal.
When authenticated with a principal API key, the new key is created for the authenticated principal. When authenticated with a service credential, principal_id is required.
Use scopes to restrict what the key can access. The default scope ["*"] grants full access. Individual scopes use the format resource:action where action is read, write, or status. For example: ["wallet:read", "wallet:write"].
Supply expires_at to set an expiry time. If omitted, the key does not expire.
Request payload for creating an API key.
The display name for this API key. Max 255 characters.
255The ID of the principal to create the API key for. Required when using service credential authentication; ignored when using principal API key authentication.
The access scopes for this key. Use ["*"] for full access, or restrict with resource:action format (for example, ["wallet:read", "wallet:write"]). Possible actions: read, write, status.
The expiry timestamp for this key, in ISO 8601 format. If omitted, the key does not expire.
Already exists (idempotent). Successful Response
Create API key result including one-time plaintext key.
Pagination metadata for list responses.
Supports both legacy offset-based and cursor-based pagination.
Cursor fields (has_more, after, before) are populated for
cursor-paginated endpoints. Legacy fields (offset, limit) are
populated when the caller uses the deprecated offset parameter.