Create Control Key

POST/enterprise/control-keys

name (max 100) and keyType (MANAGEMENT or PROVISIONING) are required. scopes is an optional allowed subset (max 16); omitted/empty uses defaults that may include writes. For monitoring explicitly request tenant:billing:read. Optional allowedIps has at most 50 IP/CIDR entries. expiresAt is a future ISO-8601 timestamp, default 90 days, maximum 365 days. apiKey is shown once.

Authentication

Enterprise-owner session JWT. Management, provisioning and inference keys are not accepted.

Authorization: Bearer <USER_JWT>

Approval and retry guide

Request body

namestringrequired

Max 100 / 最长 100

keyTypestringrequired

MANAGEMENT | PROVISIONING

scopesstring[]

Allowed subset; max 16 / 允许权限的子集，最多 16

allowedIpsstring[]

Max 50 IP/CIDR / 最多 50 个 IP/CIDR

expiresAtstring

Future ISO-8601; default 90 days, max 365 / 未来 ISO-8601，默认 90 天，最长 365 天

Fields use camelCase. Required and optional fields are described above.

JSON

1{
2  "name": "billing-monitor",
3  "keyType": "MANAGEMENT",
4  "scopes": [
5    "tenant:billing:read"
6  ]
7}

Response

HTTP 201; code: 200. Values below are illustrative; fields use camelCase.

codeinteger

200

dataobject | null

data.apiKeystring

data.credentialobject

Errors

Check both HTTP status and code; on failure inspect serviceCode, msg and traceId. Invalid credentials receive no data; enterprise-owner privileges are required. Cross-tenant resources are inaccessible. Acceptance or pending approval does not mean business completion.

Request

Shell

1curl -X POST "https://api.token360.ai/enterprise/control-keys" \
2  -H "Authorization: Bearer $USER_JWT" \
3  -H "Content-Type: application/json" \
4  --data '{"name": "billing-monitor", "keyType": "MANAGEMENT", "scopes": ["tenant:billing:read"]}'

Response

JSON

1{
2  "code": 200,
3  "msg": "success",
4  "data": {
5    "apiKey": "<ONE_TIME_CONTROL_KEY>",
6    "credential": {
7      "hash": "<KEY_HASH>",
8      "name": "service-key",
9      "keyDisplay": "sk-…",
10      "status": "ACTIVE",
11      "allowedIps": [],
12      "expiresAt": null,
13      "createdAt": "2026-11-03T00:00:00Z",
14      "keyType": "MANAGEMENT",
15      "scopes": [
16        "tenant:billing:read"
17      ]
18    }
19  }
20}

Was this page helpful?