/api/v1/api-keysPOSTCreates a new API key for the caller's organization. The secret is returned ONCE in this response and never again, so store it securely. Requires an active organization; every requested scope must be a permission the caller holds, or the request is rejected with 403.
Authorization
bearerAuth *Bearer <token>
Clerk session JWT, or an API key (the
ak_ prefix), sent as a Bearer token or an ?api_key= query parameter. Each endpoint requires the read scope for its resource (e.g. org:rates:read for rates). Token in: headerRequest Body
application/jsonrequiredname *string
scopes *string[]
Response
201 · The created API key, including its secret (returned only once).
id?string
name?string
scopes?string[]
secret?string
The API key secret. Returned only once, on creation.
created_at?integer
Creation time as a Unix epoch timestamp in milliseconds.
400 · Invalid request body (empty name or scopes)
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
401 · Unauthorized
error?string
Human-readable reason the request was not authenticated or authorized, for example a missing or malformed
Authorization header, an invalid token, or a token lacking the required scope. This is free text whose wording can change, so branch on status (or the HTTP status code) instead of on this string.status?integer
The HTTP status code repeated in the body: 401 when the credential is missing, malformed, or invalid, and 403 when it is valid but lacks the scope the endpoint requires.
403 · Active organization or API-key admin permission is missing, or a requested scope is not grantable by the caller
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
409 · A Clerk-side API key name conflict occurred.
error?string
Stable, machine-readable code identifying the failure; branch on this rather than on
message. One of bad_request, unauthorized, forbidden, not_found, conflict, service_unavailable, upstream_error, service_error, or internal_error.message?string
Human-readable explanation, safe to show to a user. For client errors it names the specific problem; for server-side failures it is a generic notice and the underlying detail is deliberately withheld.
429 · The paid organization's minute or UTC-day request budget is exhausted.
error *"rate_limited"
Always
rate_limited. Branch on this to detect a throttled request.limit *"rpm" | "daily"
Which limit was hit:
rpm for the per-minute cap or daily for the daily one.message *string
Human-readable explanation naming the limit that was exceeded.
upgrade_url?string (uri)
Page listing the plans and their request allowances, for buying a larger budget. Absent when no plan is available for purchase.
Request example
curl -X POST "https://api.adjacent.markets/api/v1/api-keys" \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "scopes": [ "string" ] }'
Response example
{ "id": "key_a1b2c3", "name": "production-readonly", "scopes": [ "org:events:read", "org:rates:read" ], "secret": "ak_live_9f8e7d6c5b4a39281706f5e4d3c2b1a0", "created_at": 1750000000000 }