Add a key to an app

POST

/api/v1/apps/{id}/keys

curl --request POST \
  --url https://example.com/api/v1/apps/example/keys \
  --header 'Content-Type: application/json' \
  --cookie bl_%3Cslug%3E_session=%3Cbl_%3Cslug%3E_session%3E \
  --data '{ "name": "example" }'

Another key, e.g. to replace one; the answer shows it this once. The body is optional.

Authorizations

• session
  operator
• dpop
  operator
• bearer
  operator

Parameters

Path Parameters

id

required

string

The id of the app.

Request Body

Media typeapplication/json

One of:

null

null

object

object

name

At most 100 characters; default the app’s name.

string | null

Example ^generated

{
  "name": "example"
}

Responses

200

OK.

Media typeapplication/json

A new key, with the key itself: shown this once.

object

id

required

string

name

required

string

key

required

Send it as Authorization: Bearer <key> to the gateway.

string

last4

string | null

created_at

Not on the key that comes with a new app.

string | null format: date-time

Example ^generated

{
  "id": "example",
  "name": "example",
  "key": "example",
  "last4": "example",
  "created_at": "2026-04-15T12:00:00Z"
}

400

The request is not valid.

Media typeapplication/json

The body of every failed call to a management API.

object

error

required

object

code

required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string

message

required

For people; may change between versions.

string

Example

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

401

No valid session, DPoP-bound token or API key.

Media typeapplication/json

The body of every failed call to a management API.

object

error

required

object

code

required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string

message

required

For people; may change between versions.

string

Example

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

403

The caller lacks the role this operation needs; or a change with the session cookie came from a page of another site (cross_site_request, decisions #83).

Media typeapplication/json

The body of every failed call to a management API.

object

error

required

object

code

required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string

message

required

For people; may change between versions.

string

Example

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

404

Not found.

Media typeapplication/json

The body of every failed call to a management API.

object

error

required

object

code

required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string

message

required

For people; may change between versions.

string

Example

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}