Create API key
Creates a new API key. The full secret (token) is returned only in this response—store it securely, it cannot be retrieved again. scopes limits what the key may call (omit them to copy the calling key’s), and kind: "team" makes a shared key that sees only what the whole account sees. Only an account admin on a plan with API access can create keys (402 plan_required otherwise), and OAuth tokens cannot create them (403 insufficient_scope).
Authorizations
API key in the format: Bearer {api_token}
Headers
Makes this write safe to retry: a repeat with the same key replays the first response instead of creating a second resource. Scoped to the account, remembered for 24 hours; reusing a key with a different payload is an error.
255Body
Optional human-readable label for the key. Defaults to "Default" when omitted.
personal acts as you. team is for shared automations: it sees and creates only what the whole account sees, and cannot run scripts.
personal, team What the key may call, as <resource>:<action>: read (every GET), write (create, change, delete; includes read), agent:run (chats, messages, run control, the AI gateway's crevio model), scripts:run (script runs), models:run (raw models through the AI gateway), connections:read and connections:run (list the team's connections, call their tools), files:read (artifact downloads), audit:read (GET /logs). run scopes are never implied by read or write. Omit to copy the calling key's scopes. A key can only grant scopes it holds.
read, write, agent:run, scripts:run, models:run, connections:run, connections:read, files:read, audit:read Response
API key created (includes the full secret)
personal acts as the person who made it; team sees only what the whole account sees.
personal, team What the key may call. Null for a key made before scopes existed, which reaches everything.

