Create a team API key
curl --request POST \
--url https://mill-api.example.com/api/team-credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://mill-api.example.com/api/team-credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://mill-api.example.com/api/team-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/team-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/team-credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/team-credentials")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/team-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "mill_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}Create a team API key
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
POST
/
api
/
team-credentials
Create a team API key
curl --request POST \
--url https://mill-api.example.com/api/team-credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://mill-api.example.com/api/team-credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://mill-api.example.com/api/team-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/team-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/team-credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/team-credentials")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/team-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "mill_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
Request conventions · API keys · MCP connections
Authorizations
Signed-in human browser session; mutation requests also need the exact UI Origin
Headers
The exact configured Mill UI origin. Required for browser mutations carrying session cookies.
Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.
Required string length:
8 - 128Pattern:
^[A-Za-z0-9._:-]+$Body
application/json
Required string length:
1 - 120Available options:
read, edit Pattern:
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Was this page helpful?
