Skip to main content
POST
Create an API key
Creates an organization-managed bd-… API key for the LLM Gateway runtime (/v1/chat/completions, /v1/messages, /v1/embeddings, etc.).
The full key value is returned only in this response. Barndoor stores a one-way hash and cannot reveal the raw key again — copy it immediately, e.g. into your secrets manager or CI environment.
A key is assigned to a single user (user_id), bound to an IdP group (group_name), or neither (a service key), but never both. Use the binding to control scope of:

Example: a CI service-account key

The response includes the raw key. From that point on, callers can use it as:
To rotate a key, create a new one and revoke the old one with DELETE /admin/api-keys/{id}. To stop a key temporarily without reissuing it, disable it instead.

Authorizations

Authorization
string
header
required

An access token from Barndoor's identity provider, sent as Authorization: Bearer <token>. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (bd-...) are not accepted here.

Body

application/json
name
string
required
expires_at
string<date-time> | null

When the key stops working. Omit for a key that does not expire.

group_name
string | null

IdP group to bind the key to, such as engineering. Requests with the key are governed by that group's budgets, rate limits, and model access policies. Cannot be combined with user_id.

scopes
string[]
user_email
string | null

Email to record on the key. Defaults to the caller's email.

user_id
string<uuid> | null

User to assign the key to. Cannot be combined with group_name. Omit both for a service key.

Response

Created

created_at
string<date-time>
required
id
string<uuid>
required
key
string
required

The full API key. Returned only in this response.

key_prefix
string
required
name
string
required
scopes
string[]
required
expires_at
string<date-time> | null
group_name
string | null