Resources
Create API Key
Create a new API key for programmatic access.
POST
/
api
/
v1
/
keys
Create API Key
curl --request POST \
--url https://api.example.com/api/v1/keys \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"scopes": [
"<string>"
],
"scope": {},
"org_id": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/keys"
payload = {
"name": "<string>",
"scopes": ["<string>"],
"scope": {},
"org_id": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', scopes: ['<string>'], scope: {}, org_id: '<string>'})
};
fetch('https://api.example.com/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'scopes' => [
'<string>'
],
'scope' => [
],
'org_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/keys"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/keys")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_bodyCreate a new API key. The full key is only returned once at creation time.
Team-shared key (targets a specific org):
Authentication
Requires a Bearer token. See Authentication.Request Body
string
Human-readable label (e.g.,
"Production Server", "Development").string[]
Permission scopes for the key (e.g.,
["completions", "skills"]). Defaults to all scopes.'personal' | 'org'
Declares whether the new key is a personal credential (visible only to you) or a team credential (shared with every member of the owning organization).
"personal"— creates a personal key.org_idmust not be provided. The server will never auto-attach your active team, even if you have permission to manage its keys."org"— creates a team-shared key. Provideorg_idto target a specific org, or omit it to fall back to your active team context.
scope is omitted, the server infers the value: "org" if org_id is present, otherwise "personal".string
Organization UUID to scope the key to. Required when
scope is "org" and the caller has no active team context. Forbidden when scope is "personal". The caller must hold the manageApiKeys permission on the target organization.Request Examples
Personal key (explicit):curl -X POST https://www.hitheo.ai/api/v1/keys \
-H "Authorization: Bearer $THEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "Production Server", "scope": "personal"}'
curl -X POST https://www.hitheo.ai/api/v1/keys \
-H "Authorization: Bearer $THEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "CI pipeline", "scope": "org", "org_id": "org_123"}'
Response
Returns the created key object. The full API key string is only included in this response — store it securely.The full key value is only shown once at creation. You cannot retrieve it later.
Endpoint
POST /api/v1/keys
Requires authentication via Bearer token. See Authentication.Was this page helpful?
Create API Key
curl --request POST \
--url https://api.example.com/api/v1/keys \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"scopes": [
"<string>"
],
"scope": {},
"org_id": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/keys"
payload = {
"name": "<string>",
"scopes": ["<string>"],
"scope": {},
"org_id": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', scopes: ['<string>'], scope: {}, org_id: '<string>'})
};
fetch('https://api.example.com/api/v1/keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'scopes' => [
'<string>'
],
'scope' => [
],
'org_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/keys"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/keys")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"scopes\": [\n \"<string>\"\n ],\n \"scope\": {},\n \"org_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body