Create API key
Issue a new API key and return the full secret in the create envelope’s plaintext_token EXACTLY ONCE. It is unrecoverable, so hand it to the user immediately and never log or echo it; if lost, rotate. Callable by a human (api_keys.manage) or by a parent api_key, in which case the issued permissions MUST be a subset of the parent’s (downscoping only; escalation → 403). Default expires_at = now + 3 years; pass null for a perpetual key. Natural key (team_sid, name) among non-revoked keys → a duplicate returns already_exists with the existing key (and NO secret).
Contract:
- MCP tool
create_api_key, registry packagemcp.id/api_keys, mountid.access. - Operation
create, response envelopecreate. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Body
Request body of create_api_key.
Human-readable key name; unique among the team's non-revoked keys.
1 - 255Unified permission list; must be ⊆ the parent key on delegation.
128ISO 8601 UTC; omit = now + 3 years; null = perpetual.