Create an API key

POST

/api/admin/api-keys

Creates a new scoped API key tied to one of the user's organizations.
The full key value (xntr-...) is returned only once in key_value
and is never stored in plaintext. Copy it immediately.

Key format: xntr- prefix followed by 86 URL-safe base64 characters
(91 characters total).

IP Whitelist: optionally restrict the key to specific IPs or CIDR
ranges. If allowed_ips is null or empty, the key is usable from any IP.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

API key created. Copy key_value — it is shown only once.

Bodyapplication/json

🟠400

🟠403

🟠404

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://my.xentree.ai/api/admin/api-keys' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "Production LMS Integration",
    "organization_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "permissions": [
        "conversations:read",
        "conversations:write"
    ],
    "rate_limit_per_minute": 60,
    "expires_at": null,
    "allowed_ips": [
        "203.0.113.42",
        "10.0.0.0/8"
    ]
}'

Response Example

{
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "name": "string",
    "prefix": "xntr-TM2s4obr3gg",
    "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
    "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
    "organization_name": "string",
    "permissions": [
        "string"
    ],
    "rate_limit_per_minute": 0,
    "expires_at": "2019-08-24T14:15:22.123Z",
    "is_active": true,
    "last_used_at": "2019-08-24T14:15:22.123Z",
    "created_at": "2019-08-24T14:15:22.123Z",
    "allowed_ips": [
        "string"
    ],
    "key_value": "xntr-TM2s4obr3ggt76DWVZoxSF48H6OMXnkI..."
}

Modified at 2026-06-30 10:13:57

List API keys

Delete an API key