Skip to main content

​
API key types

POST /v1/api-keys takes the same fields as the MCP create_api_key tool. type picks what the key can reach:
  • user (the default): every project you can access, following your live workspace role. Use it for a coding agent working on your behalf, such as Codex or Claude Code. Send projectIds: null. User keys must expire, so send expiresInDays (1–366).
  • project: only the projects in projectIds, one or more that you can manage. Use it for CI or automation. expiresInDays may be null for a key that lasts until revoked.
Every request sends workspaceId, name, projectIds, scopes (repo.read to clone, add repo.write to push) and expiresInDays. The response returns the secret once, Git connection details, type and projectIds (null for a user key). Creating an eleventh live user key revokes the least recently used one, with unused keys first. Create and revoke both kinds in Settings → API Keys.

​
Migration

This is a breaking change in 2026-10-29: project keys take projectIds (a list) instead of projectId, and the response returns projectIds. Requests pinned to 2026-10-05 or earlier keep the original contract: a single projectId, a key that never expires, and projectId in the response. Site objects include their Git clone URL. Expired Git credentials report how to replace them. These improvements apply across versions.