Create API Key

Create a key. The response holds the only copy of it.

POSThttps://api.foxreach.io/api/v1/api-keys

Requires an API key with the admin scope.

N e Not available while acting as a client workspace. API keys are never created, listed or revoked over MCP.

A new key can only hold scopes the calling key holds, and only read, write and admin. Leave scopes out to copy the calling key's scopes. A key with only read cannot create keys at all. The call writes an audit.api_key.created entry with the key id, name, prefix and scopes, never the key.

Body Parameters#

namestringbodyrequired

A name unique in the workspace, up to 100 characters.

scopesstring[]body

Any non-empty subset of read, write, admin that the calling key also has.

Response#

Returns the key in data with a key field holding the full secret. It is shown once and cannot be retrieved again.

Errors#

Status	Description
`401`	Missing, invalid, revoked or expired API key
`403`	The key lacks the `admin` or `write` scope, or its creator lacks the required role
`403`	Asked for a scope the calling key does not hold (`scope_escalation`)
`403`	Called while acting as a client workspace with `X-Workspace-Id` (`acting_as_forbidden`)
`409`	A key with that name already exists
`422`	Unknown scope, empty scopes, or a bad name

Rate Limit#

120 requests per minute, shared by every write call in your workspace. Fixed 60-second window.
Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (unix epoch seconds) and X-RateLimit-Bucket (write).
A 429 response includes a Retry-After header (seconds until the bucket resets).

For client-side patterns, see Rate Limiting.

Request

cURL

curl -X POST "https://api.foxreach.io/api/v1/api-keys" \
  -H "X-API-Key: otr_your_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI deploy", "scopes": ["read", "write"]}'

Python SDK

from foxreach import FoxReach

client = FoxReach(api_key="otr_your_key")
created = client.api_keys.create("CI deploy", scopes=["read", "write"])

TypeScript SDK

import { FoxReach } from "foxreach";

const client = new FoxReach({ apiKey: "otr_your_key" });
const created = await client.apiKeys.create({ name: "CI deploy", scopes: ["read", "write"] });

Response

JSON

{ "data": { "id": "cak_abc123", "name": "CI deploy", "prefix": "otr_ab12", "scopes": ["read", "write"], "lastUsedAt": null, "expiresAt": null, "createdAt": "2026-11-04T09:30:00+00:00" , "key": "otr_..." } }

Was this page helpful?

View as MarkdownLast updated November 4, 2026