Skip to main content
POST
Create API key
The response shows the plaintext key once. Store it securely before leaving the response; Darwin cannot retrieve it later.

Manage API keys in Darwin

Create and revoke keys from Developer settings.

Authorizations

__Secure-better-auth.session_token
string
cookie
required

The HTTP-only Darwin account session cookie set after sign-in. Local development uses better-auth.session_token without the __Secure- prefix.

Body

application/json
name
string
required

A recognizable name for the environment or integration that will use this key.

Required string length: 1 - 120
Example:

"Production server"

scopes
string[]

Optional permissions for the key. Omit this field to grant the current default developer scopes; prefer the narrowest scopes your integration needs.

Minimum array length: 1
Example:
expiresAt
string<date-time> | null

Optional future ISO 8601 expiration. Omit or set null for no scheduled expiration.

Example:

"2027-09-21T00:00:00.000Z"

Response

The API key was created. Store apiKey securely because Darwin will not return it again.

id
string
required

Stable non-secret identifier for the API key.

name
string
required

Human-readable key name supplied at creation.

prefix
string
required

Non-secret prefix you can use to identify the key in logs and settings.

scopes
string[]
required

Permissions granted to the key. Every API operation still enforces its required scope.

requestCount
integer
required

Lifetime number of requests authenticated with this key.

Required range: x >= 0
lastUsedAt
string<date-time> | null
required

When Darwin most recently authenticated a request with this key, or null if unused.

expiresAt
string<date-time> | null
required

When the key expires, or null when it has no scheduled expiration.

revokedAt
string<date-time> | null
required

When the key was revoked, or null while it has not been revoked.

createdAt
string<date-time>
required

When the key was created.

apiKey
string
required
read-only

Plaintext API key. Darwin returns this value only in the create response.

Last modified on September 21, 2026