Create an API key

POST/v1/projects/{projectId}/keys

This operation supports dashboard session-cookie authentication. Call it only from trusted server code; browsers must not manufacture or expose the session cookie.

The response contains keyRaw exactly once; only an argon2id hash is stored. Session-cookie auth only. Rate limit: 60 requests per 60 s per session.

Error codes: unauthorized (401), not_found (404), invalid_name (400), invalid_scopes (400), key_generation_failed (500).

Authentication

sessionCookie — Dashboard session cookie set by POST /v1/auth/login. Video and playback endpoints additionally require the projectId query parameter under cookie auth.

Parameters

Name	In	Type	Required	Description
`projectId`	path	string (Ulid)	Yes	—

Request body

required

Content type: application/json

Schema: ApiKeyCreateRequest

{
  "name": "backend-server",
  "scopes": [
    "read",
    "write"
  ]
}

Responses

Status	Meaning
`201`	Key created. Store `keyRaw` now; it is never shown again.
`400`	The request body or query failed validation. The per-operation description lists the exact `error.code` values.
`401`	No valid credential was presented.
`404`	The resource does not exist or is not visible to this caller.
`429`	Rate limit exceeded.
`500`	The server failed to complete the request.

Example request

{
  "name": "backend-server",
  "scopes": [
    "read",
    "write"
  ]
}