Create an API key
Creates a key and returns its secret once, in secret. Store it now: no other response carries it, and a lost secret is rotated, not recovered.
Requires keys_write; a service_account principal also needs members_write. Every requested scope must be one the caller holds. Scopes are sorted, deduplicated and fixed at creation. Keys do not expire. See API keys.
Authorizations
An API key (otsk_ + 64 hex) or a console session token.
Body
A label shown in the console. Not unique.
At least one scope, each held by the caller.
A permission a key or session holds.
runs_read, runs_write, keys_read, keys_write, members_read, members_write, billing_read, billing_write, usage_read Which identity the key acts as. Omitted means the calling user, which is the console's default for a personal key.
- Option 1
- Option 2
Response
The key, with its secret.
A key with its secret. Only create and rotate return this.
Who a key acts as: a user, or a service account owned by the organization.
- Option 1
- Option 2
A permission a key or session holds.
runs_read, runs_write, keys_read, keys_write, members_read, members_write, billing_read, billing_write, usage_read A revoked key is kept, never deleted.
active, revoked The first 13 characters of the secret (otsk_ plus 8), for display.
The plaintext secret. Shown once. The service stores only its SHA-256 and cannot return this value again; a lost secret is rotated, not recovered.