Create a personal API key
curl --request POST \
--url https://mill-api.example.com/api/credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://mill-api.example.com/api/credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://mill-api.example.com/api/credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/credentials")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "mill_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}Create a personal API key
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
POST
/
api
/
credentials
Create a personal API key
curl --request POST \
--url https://mill-api.example.com/api/credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://mill-api.example.com/api/credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://mill-api.example.com/api/credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/credentials")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "mill_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}A signed-in human session with recent authentication is required. Complete password/passkey reauthentication when requested.
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
Request conventions · API keys · MCP connections
Authorizations
Signed-in human browser session; mutation requests also need the exact UI Origin
Headers
The exact configured Mill UI origin. Required for browser mutations carrying session cookies.
Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.
Required string length:
8 - 128Pattern:
^[A-Za-z0-9._:-]+$Body
application/json
Required string length:
1 - 120Available options:
read, edit Pattern:
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Was this page helpful?
