> ## Documentation Index
> Fetch the complete documentation index at: https://www.mill.fyi/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a team API key

> Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor's authority.

A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.

Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor's authority.

[Request conventions](https://www.mill.fyi/api-reference/overview.md) · [API keys](https://www.mill.fyi/api-keys.md) · [MCP connections](https://www.mill.fyi/mcp-connections.md)


## OpenAPI

````yaml api-reference/openapi.json POST /api/team-credentials
openapi: 3.1.0
info:
  title: Mill HTTP API
  version: 1.0.6
  description: >-
    All registered task-board, account, OAuth, MCP transport and health
    operations. MCP tool schemas come from runtime validators; account
    operations follow their server handlers. Example data is fictional.
    Generation imports routes without issuing requests or connecting to a
    database.
servers:
  - url: https://mill-api.example.com
security: []
paths:
  /api/team-credentials:
    post:
      tags:
        - API key management
      summary: Create a team API key
      description: >-
        Requires recent authentication. Returns the new bearer secret once. Read
        access cannot mutate; includeAdmin requests administrative operations
        within the actor's authority.


        A signed-in human administrator is required. API keys and MCP
        credentials cannot replace that session. Sensitive operations can also
        require recent authentication.
      operationId: post_api_team_credentials
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Mill UI origin. Required for browser mutations
            carrying session cookies.
        - name: Idempotency-Key
          in: header
          required: false
          schema:
            type: string
            minLength: 8
            maxLength: 128
            pattern: ^[A-Za-z0-9._:-]+$
          description: >-
            Reuse the same key and exact request bytes for retries of one
            logical mutation; different content conflicts.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 120
                access:
                  type: string
                  enum:
                    - read
                    - edit
                includeAdmin:
                  type: boolean
                expiresAt:
                  anyOf:
                    - type: string
                      format: date-time
                      pattern: >-
                        ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
                    - type: 'null'
              required:
                - name
                - access
                - includeAdmin
                - expiresAt
              additionalProperties: false
      responses:
        '201':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  credential:
                    type: object
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                      accessLevel:
                        type: string
                      includeAdmin:
                        type: boolean
                      tokenType:
                        type: string
                      tokenPrefix:
                        type: string
                      createdAt:
                        type: string
                      expiresAt:
                        type:
                          - string
                          - 'null'
                      revokedAt:
                        type:
                          - string
                          - 'null'
                    additionalProperties: true
                  token:
                    type: string
                additionalProperties: true
                description: >-
                  Illustrative response shape. Fields can be absent in alternate
                  successful flows; see the operation description and example.
              example:
                credential:
                  id: 66666666-6666-4666-8666-666666666666
                  name: Studio assistant
                  accessLevel: read
                  includeAdmin: false
                  tokenType: api-key
                  tokenPrefix: mill_example
                  createdAt: '2027-01-18T09:30:00.000Z'
                  expiresAt: null
                  revokedAt: null
                token: example-private-key-returned-once
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: mill_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.