Skip to main content
POST
Create a team API key
A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication. Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority. Request conventions · API keys · MCP connections

Authorizations

mill_session
string
cookie
required

Signed-in human browser session; mutation requests also need the exact UI Origin

Headers

Origin
string<uri>
required

The exact configured Mill UI origin. Required for browser mutations carrying session cookies.

Idempotency-Key
string

Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.

Required string length: 8 - 128
Pattern: ^[A-Za-z0-9._:-]+$

Body

application/json
name
string
required
Required string length: 1 - 120
access
enum<string>
required
Available options:
read,
edit
includeAdmin
boolean
required
expiresAt
string<date-time> | null
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$

Response

Successful response. Examples are illustrative; field values vary by record.

Illustrative response shape. Fields can be absent in alternate successful flows; see the operation description and example.

credential
object
token
string