Skip to content
AiKYNETIX

Create an API key

POST
/api/api-keys/
curl -X POST https://api.ai.aikynetix.app/api/api-keys/ \
  -H 'Authorization: Bearer <firebase-id-token>' \
  -H 'Content-Type: application/json' \
  -d '{"label":"production webhook"}'

Mints a new long-lived bearer token scoped to the active team. Owner-only — member-role coaches get 403. Minting also requires the Organization plan or higher (403 api_keys_require_upgraded_plan otherwise; listing and revoking stay open on every tier). The plaintext token is returned exactly once, in this response — store it immediately; we keep only a SHA-256 hash and cannot recover it. Use the returned aik_… token in Authorization: Bearer aik_… headers for server-to-server integrations. Rotate by minting a new key + revoking the old one (DELETE /api/api-keys/<id>/).

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
object
label
required

Friendly label so the team owner can tell keys apart. Visible only to authenticated team members.

string
>= 1 characters <= 100 characters
Examples
ExampleNameTheKey

Name the key

{
  "label": "production webhook"
}

Responses

Section titled “Responses”

201

Section titled “201”
Media typeapplication/json
object
id
required

Key UUID. Pass to DELETE /api/api-keys/<id>/ to revoke.

string format: uuid
label
required

The label supplied at creation.

string
token
required

The plaintext aik_… bearer token. Shown exactly once — we store only a SHA-256 hash and cannot recover it. Store it now; use it in Authorization: Bearer aik_… headers.

string
created_at
required

ISO-8601 UTC of creation.

string format: date-time
Examples
ExampleCreated—TokenShownOnce

Copy `token` now; it is never returned again

{
  "id": "9b1c7e2a-4d3f-4a8b-9c0d-1e2f3a4b5c6d",
  "label": "production webhook",
  "token": "aik_S3cr3tT0k3nValueShownOnceDoNotShare1234",
  "created_at": "2026-04-30T08:00:00Z"
}

400

Section titled “400”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examplegenerated
{
  "detail": "example"
}

401

Section titled “401”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examplegenerated
{
  "detail": "example"
}

403

Section titled “403”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string
Examples

Only the owner can mint or revoke keys

{
  "detail": "Only the team owner can manage API keys"
}