Generates the approved key and returns its secret once. Must be
called by the same credential that made the request, with the
claim_token it was given, within an hour of approval. The calling
credential must still be active and still hold every approved scope.
The key expires after the approved lifetime and is revoked
automatically if the requesting key or OAuth connection is revoked. A
second claim is 409; a request that is not yet approved, was denied,
or has lapsed is 409 too. The response is sent with
Cache-Control: no-store; hand the secret straight to where it will be
used and do not log it.
Path parameters
id string<uuid> required
The API key request's id, as returned when it was made.
Request body
Content type: application/json
claim_token string required
The token returned when the request was made.
Responses
Errors follow the RFC 7807 problem format — see the error reference.
201 The minted key and its secret, shown onceapplication/json
key object required
Fields of key:
id string<uuid> required
name string required
environment string enum required
One of: live, test
key_prefix string required
scopes array<string> required
expires_at string<date-time> | null required
secret string required
The API key (sk_live_… or sk_test_…).
401 Missing, malformed, or unknown API keyapplication/problem+json
403 Key lacks the required scope or plan limit violatedapplication/problem+json
404 Resource not foundapplication/problem+json
409 The mutation is rejected by a state rule rather than a bad request. The
code is conflict.
application/problem+json
422 A query parameter, path value or body field failed validation.
The body is a validation_failed Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries validation_code,
field, line/column, missing, candidates and next_step, so a
client can correct the call without a second round of guessing. See
ValidationProblem.
application/problem+json
500 Unexpected server-side failure. The code is internal_error. The
request_id field can be quoted to SendOps support to investigate.
application/problem+json