Create API key

Create a new DB-backed API key with optional tenant scoping and TTL.

POST /auth/keys

curl -X POST http://localhost:3000/auth/keys \
  -H "Authorization: Bearer $ISOL8_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-runner", "tenantId": "team-infra", "ttlMs": 86400000 }'

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "key": "isol8_4f3c8a1b...",
  "name": "ci-runner",
  "keyPrefix": "isol8_4f3c...",
  "tenantId": "team-infra",
  "expiresAt": "2026-03-02T12:00:00.000Z"
}

Creates a new API key in the SQLite-backed key store. The plaintext key is returned only once in the response — store it securely.

Requires the master key (the --key flag value). DB-backed auth must be enabled via --auth-db or config.

name · string · required

Human-readable label for this key.

tenantId · string

Tenant identifier for multi-tenant isolation. Defaults to "default".

ttlMs · number

Key lifetime in milliseconds. Defaults to auth.defaultTtlMs from server config.

id · string

Unique key identifier (UUID). Use this for revocation.

key · string

Plaintext API key prefixed with isol8_. Shown only once.

name · string

The label provided at creation.

keyPrefix · string

First 10 characters of the key followed by ... for display purposes.

tenantId · string

Tenant this key belongs to.

expiresAt · string

ISO 8601 expiration timestamp.

curl -X POST http://localhost:3000/auth/keys \
  -H "Authorization: Bearer $ISOL8_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-runner", "tenantId": "team-infra", "ttlMs": 86400000 }'

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "key": "isol8_4f3c8a1b...",
  "name": "ci-runner",
  "keyPrefix": "isol8_4f3c...",
  "tenantId": "team-infra",
  "expiresAt": "2026-03-02T12:00:00.000Z"
}

The plaintext key is returned only at creation time. It cannot be retrieved later — only the keyPrefix is stored for display.