Create Member API Key

POST/enterprise/v1/sub-accounts/{subAccountId}/api-keys

name is required, at most 100 characters. workspaceCode defaults to DEFAULT. Optional expiresAt uses ISO-8601; allowedIps accepts at most 50 IP/CIDR entries. spendLimit is a positive USD amount; omitted means no key budget. limitReset is daily, weekly, monthly, or null for lifetime. apiKey is returned once; retain credential.hash for later management.

Authentication

MANAGEMENT / PROVISIONING key with tenant:keys:write.

Authorization: Bearer <CONTROL_KEY>

Any subAccountId must belong to the authenticated enterprise. hash is a metadata identifier, never a raw key.

Approval and retries

Approval-enabled enterprises require Idempotency-Key and may receive HTTP 409 / APPROVAL_REQUIRED with data.operation.executed=false. Nothing has executed at that point. Other enterprises execute directly; do not assume arbitrary POST requests support idempotent retries.

Approval and retry guide

Path parameters

subAccountIdstringrequired

10-digit public member ID / 10 位成员编号

Request body

namestringrequired

At most 100 characters / 最长 100 字符

workspaceCodestring

Default: DEFAULT / 默认 DEFAULT

expiresAtstring

ISO-8601

allowedIpsstring[]

Up to 50 IP/CIDR entries / 最多 50 个 IP/CIDR

spendLimitnumber

USD > 0 / 美元正数

limitResetstring | null

daily | weekly | monthly | null (lifetime / 累计)

Fields use camelCase. Required and optional fields are described above.

JSON

1{
2  "name": "service-key",
3  "spendLimit": 100,
4  "limitReset": "monthly"
5}

Response

HTTP 201; code: 200. Values below are illustrative; fields use camelCase.

codeinteger

200

dataobject | null

data.apiKeystring

data.credentialobject

Errors

Check both HTTP status and code; on failure inspect serviceCode, msg and traceId. Invalid credentials receive no data; missing scopes return API_KEY_SCOPE_DENIED. Cross-tenant resources are inaccessible. Acceptance or pending approval does not mean business completion.

Request

Shell

1curl -X POST "https://api.token360.ai/enterprise/v1/sub-accounts/{subAccountId}/api-keys" \
2  -H "Authorization: Bearer $CONTROL_KEY" \
3  -H "Idempotency-Key: <UNIQUE_INTENT_ID>" \
4  -H "Content-Type: application/json" \
5  --data '{"name": "service-key", "spendLimit": 100, "limitReset": "monthly"}'

Response

JSON

1{
2  "code": 200,
3  "msg": "success",
4  "data": {
5    "apiKey": "<ONE_TIME_API_KEY>",
6    "credential": {
7      "hash": "<KEY_HASH>",
8      "name": "service-key",
9      "keyDisplay": "sk-…",
10      "workspaceCode": "DEFAULT",
11      "status": "ACTIVE",
12      "allowedIps": [],
13      "spendLimit": 100,
14      "limitReset": "monthly",
15      "expiresAt": null,
16      "createdAt": "2026-11-03T00:00:00Z"
17    }
18  }
19}

Was this page helpful?