Skip to main content
POST
Create an API key

Authorizations

Authorization
string
header
required

Authorization: Bearer <token>. Token types resolve to the same scoped credential: a user-generated API key (casa_…, from Account settings — recommended for machines and MCP clients), a WorkOS AuthKit session JWT (the web app; org and role come from verified token claims), or a static token. API keys are group-scoped, optionally pinned to one property at creation. MCP OAuth connector tokens authenticate the MCP server only and are rejected on these REST routes.

Headers

X-Organization-Id
string

Active WorkOS organization (property group). Optional cross-check for session (JWT) auth: when sent it must equal the token's verified org_id claim, else 403. The org is taken from the claim, not this header. Ignored for API keys and static tokens.

Body

application/json
name
string
required
Example:

"Reporting pipeline"

property_id
string<uuid> | null

Pin the key to one property in the group. Omit/null for group scope.

Response

Key created. token is shown once.

data
object
required

A user-generated API key. Only the display prefix is ever returned after creation; the token itself is hashed at rest.

token
string
required

The plaintext bearer token. Never available again.

Example:

"casa_Zg3n1kQ9…"