Create an API key
Mint a new tenant API key. The key value is returned ONLY on this response (Cache-Control: no-store) — store it immediately. mode: 'test' activates sandbox-mode (no real provider hits, no billing). Optional per-key allowed_ips enforces an IP allowlist at auth time.
Authorizations
Dashboard JWT token from Clerk
Body
Human-readable label shown in the dashboard. Not used for authentication.
1 - 100secret = server-only dv_*_sk_* key; public = browser-safe pk_* key for the embed SDK.
secret, public API key permission scopes (e.g. messages:write). At least one scope is required for keys minted after 2026-08-01; empty-scope keys are deprecated and treated as least-privilege (viewer) / will be rejected after the grandfather deadline.
test keys never deliver messages and never bill; useful for CI/staging.
live, test never, 30d, 90d, 1y Optional IP/CIDR allowlist. Auth middleware rejects requests from a non-allowlisted source.
501 - 64