/api/v1/api-keysPOSTCreates a new API key for the caller's organization.
Authorization
bearerAuth *Bearer <token>
Session token from the app, or an API key (the
ak_ prefix), sent as a Bearer token or an ?api_key= query parameter.. Token in: headerRequest Body
application/jsonrequiredname *string
scopes *string[]
Response
201 · The created API key, including its secret (returned only once).
id?string
name?string
scopes?string[]
secret?string
The API key secret. Returned only once, on creation.
created_at?integer
Creation time as a Unix epoch timestamp in milliseconds.
400 · Invalid request body (empty name or scopes)
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
401 · Unauthorized
error?string
Human-readable reason the request was not authenticated or authorized, for example a missing or malformed
Authorization header, an invalid token, or a token lacking the required scope. This is free text whose wording can change, so branch on status (or the HTTP status code) instead of on this string.status?integer
The HTTP status code repeated in the body.
403 · The caller has no active organization, cannot manage API keys, or requested a scope they cannot grant
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
409 · A rare name collision.
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
429 · The organization's minute or UTC-day request budget is exhausted, or the organization has reached its cap on requests running at the same time (`limit: "concurrency"`). Wait `Retry-After` seconds before retrying; for a concurrency 429, reduce parallelism.
error *"rate_limited"
Always
rate_limited. Branch on this to detect a throttled request.limit *"rpm" | "daily" | "concurrency"
Which limit was hit:
rpm for the per-minute cap, daily for the daily one, or concurrency for the cap on requests running at the same time.message *string
Human-readable explanation naming the limit that was exceeded.
upgrade_url?string (uri)
Page listing the plans and their request allowances, for buying a larger budget. Absent when no plan is available for purchase.
Request example
curl -X POST "https://api.adjacent.markets/api/v1/api-keys" \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "scopes": [ "string" ] }'
Response example
{ "id": "key_a1b2c3", "name": "production-readonly", "scopes": [ "org:events:read", "org:rates:read" ], "secret": "ak_live_9f8e7d6c5b4a39281706f5e4d3c2b1a0", "created_at": 1750000000000 }