Create an API key and read its secret

POST

api-keys

# cookies.txt holds the cookies from your signed-in console session.
curl --request POST "$MITHUNAI_URL/arukz/api/v1/api-keys" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"name": "CI pipeline", "role": "normal", "expires_in_days": 90}'

import os
from http.cookiejar import MozillaCookieJar

import requests

# cookies.txt holds the cookies from your signed-in console session.
jar = MozillaCookieJar("cookies.txt")
jar.load()

response = requests.post(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    json={"name": "CI pipeline", "role": "normal", "expires_in_days": 90},
    timeout=30,
)
response.raise_for_status()
key = response.json()
print(key["secret"])  # Store this now. It is never shown again.

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const response = await fetch('/arukz/api/v1/api-keys', {
  method: 'POST',
  credentials: 'include',
  headers: {
    'Content-Type': 'application/json',
    'X-CSRF-Token': csrfToken,
  },
  body: JSON.stringify({ name: 'CI pipeline', role: 'normal', expires_in_days: 90 }),
})
const key = await response.json()
console.log(key.secret) // Store this now. It is never shown again.

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "active",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": null,
  "last_used_at": null,
  "secret": "arukz_sk_3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b_SYUCMXvMc88oKrt2Jfhbg2aHdLCH5e1dhJi7mx6du8M",
  "warning": "This secret is shown once and cannot be retrieved again. Store it securely."
}

{ "code": "validation_error", "message": "That is not a role an API key may be given." }

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "conflict", "message": "An API key with that name already exists." }

This endpoint takes a signed-in console session, not an API key. Send the session cookies your browser received when you signed in, plus the X-CSRF-Token header set to the value of the csrf_token cookie. A request authenticated with an arukz_sk_ key is refused with 403, even when that key has the owner role: a key cannot manage keys. See Managing API keys. The response is the only one that ever contains the key’s secret. The server does not store it and cannot show it again. If you lose it, create a new key and revoke the old one. You need the owner or admin role. You cannot give a key a role more senior than your own: an owner can grant any of the five roles, an admin can grant any role except owner, and asking for a role above your own returns 403. Key names are unique within your organization; a name that is already taken returns 409.

string

required

The value of your session’s csrf_token cookie (named __Host-csrf_token when the console is served over HTTPS without a shared cookie domain). Required on this request because it changes state; a missing or mismatched token returns 401.

string

required

A label for the key, shown in listings. Leading and trailing whitespace is trimmed; the result must be 1 to 120 characters, with no control, invisible formatting (such as zero-width or bidirectional-override), private-use or line-separator characters.

string

default:"normal"

The role the key acts with. One of owner, admin, editor, normal or dataset_operator. normal is the member role: it can ask assistants questions and read answers, which is what most integrations need. Choose the narrowest role that works. See Organizations and roles.

integer

Lifetime in whole days, from 1 to 730. Omit it, or send null, for a key that does not expire. An expired key stops authenticating without further action.

Response

Returns 201 Created with the key’s metadata, its secret and a warning.

string

required

The key’s ID (UUID).

string

required

The key’s label.

string

required

A non-secret fragment, arukz_sk_ followed by the first 8 characters of the ID, so you can match a listing row to the key in your configuration.

string

required

owner, admin, editor, normal or dataset_operator.

string

required

Always active on creation.

string

required

When the key was created, ISO 8601 in UTC.

string | null

required

ID of the user who created the key.

string | null

required

When the key expires, or null if it does not.

string | null

required

Always null on creation.

string | null

required

Always null on creation.

string

required

The full credential, arukz_sk_<id>_<secret>. Send it as Authorization: Bearer <secret>. Returned only in this response.

string

required

A reminder that the secret is shown once and cannot be retrieved again.

# cookies.txt holds the cookies from your signed-in console session.
curl --request POST "$MITHUNAI_URL/arukz/api/v1/api-keys" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"name": "CI pipeline", "role": "normal", "expires_in_days": 90}'

import os
from http.cookiejar import MozillaCookieJar

import requests

# cookies.txt holds the cookies from your signed-in console session.
jar = MozillaCookieJar("cookies.txt")
jar.load()

response = requests.post(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    json={"name": "CI pipeline", "role": "normal", "expires_in_days": 90},
    timeout=30,
)
response.raise_for_status()
key = response.json()
print(key["secret"])  # Store this now. It is never shown again.

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const response = await fetch('/arukz/api/v1/api-keys', {
  method: 'POST',
  credentials: 'include',
  headers: {
    'Content-Type': 'application/json',
    'X-CSRF-Token': csrfToken,
  },
  body: JSON.stringify({ name: 'CI pipeline', role: 'normal', expires_in_days: 90 }),
})
const key = await response.json()
console.log(key.secret) // Store this now. It is never shown again.

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "active",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": null,
  "last_used_at": null,
  "secret": "arukz_sk_3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b_SYUCMXvMc88oKrt2Jfhbg2aHdLCH5e1dhJi7mx6du8M",
  "warning": "This secret is shown once and cannot be retrieved again. Store it securely."
}

{ "code": "validation_error", "message": "That is not a role an API key may be given." }

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "conflict", "message": "An API key with that name already exists." }

Last modified on September 26, 2026

⌘I

# cookies.txt holds the cookies from your signed-in console session.
curl --request POST "$MITHUNAI_URL/arukz/api/v1/api-keys" \
  --cookie cookies.txt \
  --header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"name": "CI pipeline", "role": "normal", "expires_in_days": 90}'

import os
from http.cookiejar import MozillaCookieJar

import requests

# cookies.txt holds the cookies from your signed-in console session.
jar = MozillaCookieJar("cookies.txt")
jar.load()

response = requests.post(
    f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/api-keys",
    cookies=jar,
    headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
    json={"name": "CI pipeline", "role": "normal", "expires_in_days": 90},
    timeout=30,
)
response.raise_for_status()
key = response.json()
print(key["secret"])  # Store this now. It is never shown again.

// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const response = await fetch('/arukz/api/v1/api-keys', {
  method: 'POST',
  credentials: 'include',
  headers: {
    'Content-Type': 'application/json',
    'X-CSRF-Token': csrfToken,
  },
  body: JSON.stringify({ name: 'CI pipeline', role: 'normal', expires_in_days: 90 }),
})
const key = await response.json()
console.log(key.secret) // Store this now. It is never shown again.

{
  "id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
  "name": "CI pipeline",
  "prefix": "arukz_sk_3f2a1c9e",
  "role": "normal",
  "status": "active",
  "created_at": "2026-09-20T14:03:11.482190+00:00",
  "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "expires_at": "2026-12-19T14:03:11.482190+00:00",
  "revoked_at": null,
  "last_used_at": null,
  "secret": "arukz_sk_3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b_SYUCMXvMc88oKrt2Jfhbg2aHdLCH5e1dhJi7mx6du8M",
  "warning": "This secret is shown once and cannot be retrieved again. Store it securely."
}

{ "code": "validation_error", "message": "That is not a role an API key may be given." }

{ "code": "authentication_error", "message": "Authentication is required." }

{ "code": "authorization_error", "message": "API key management requires a signed-in user." }

{ "code": "conflict", "message": "An API key with that name already exists." }

Get started

Conversations

Assistants

Models

Knowledge

Widget deployments

Widget (public)

MCP

API keys

Members

Analytics

Support access

Branding

Operations

Create an API key and read its secret

Response

​Response

Response