Skip to main content
POST

Authorizations

​
Authorization
string
header
required

Primary scheme: Authorization: Key <key_id>:<secret>.

Body

application/json
​
ttl_seconds
integer | null

Seconds until the token expires; omitted means the service default.

​
scopes
enum<string>[] | null

Scopes granted to the token. Omitted means every scope of the minting key; an explicit subset narrows the grant, and requesting beyond the key's scopes is a 403.

Least-privilege grants carried by v3 API keys.

Stored as text[] on api_keys; NULL scopes means full access (legacy keys). Scopes are stored as text so new least-privilege surfaces can be introduced without a database-enum migration.

Available options:
jobs:read,
jobs:write,
models:read,
files:write,
webhooks:manage,
log_drains:manage,
usage:read,
keys:manage

Response

Successful Response

​
token
string
required

The ephemeral token — a valid Bearer credential until it expires. Shown exactly once.

​
expires_at
string<date-time> | null

ISO-8601 instant the token stops authenticating.