身份验证
请将 API 密钥作为 bearer 令牌发送。该密钥必须具有 apikeys.manage 权限；缺少该权限的密钥将被拒绝并返回 403 状态码，而非 404。
您的组织 ID 应填在此处
此端点接受 org_id 作为 JSON 正文中的一个字段。
您的组织ID位于控制面板的API密钥屏幕上，就在密钥本身的旁边。这是您在每次调用时使用的相同ID。
免费试用
将尖括号中的内容替换为您自己的值，并将键占位符替换为您仪表板中的一个键。
curl -X POST https://api.zinndigital.com/v1/api-keys \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "name": <string> }'已登录？您仪表板中的 API 控制台会自动填入您真实的组织 ID 和您自己的密钥，并针对实时 API 运行请求，以便您查看实际的响应。 在 API 控制台中打开此端点
详细信息
Mints a new per-org API key and returns the full `zdk_…` token **once** — only its hash is stored, so a lost token is replaced, never recovered. The requested `scopes` must be permissions the caller already holds in the target org; asking for one you do not hold is a `403` (a key can never out-scope its creator). Send an `Idempotency-Key` so a retry after a lost response returns the same token rather than orphaning a key. Requires `apikeys.manage`.
参数
| 名称 | 类型 | 必填 | 内容简介 |
|---|---|---|---|
Idempotency-Key (header) | string | 否 | Client-generated key that makes an unsafe request replay-safe: the server stores the first response and returns it verbatim for repeats. |
请求正文
| 名称 | 类型 | 必填 | 内容简介 |
|---|---|---|---|
name | string | 是 | — |
scopes | string[] | 否 | RBAC permission keys to grant. Each must be a permission the caller holds in the target org (a key can never out-scope its creator); an unheld scope is a `403`, an unknown one a… |
sandbox | boolean | 否 | Mint a sandbox (test-mode) key. Defaults to false. |
org_id | Uuid | null | 否 | The organization the key belongs to. Defaults to the caller's org; the caller must hold `apikeys.manage` in the target org. |
响应
| 名称 | 类型 | 必填 | 内容简介 |
|---|---|---|---|
id | Uuid | 是 | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
name | string | 是 | — |
prefix | string | 是 | The key's public lookup id (the middle segment of the token). |
scopes | string[] | 是 | The RBAC permission keys this key may exercise. |
sandbox | boolean | 是 | A sandbox (test-mode) key suppresses billing + provisioning (docs/09 §2). |
last_used_at | object | 否 | When the key last authenticated a request; null if never used. |
revoked_at | object | 否 | Always null on a listed/fetched key — revoked keys are not returned. |
created_at | string | 是 | — |
token | string | 是 | The full `zdk_<mode>_<prefix>_<secret>` token. Shown **once, here only** — store it now; it cannot be retrieved again, only replaced. |
此端点可能返回的错误
401 · 403 · 409 · 422 · 429