Skip to content
Logo

POST /auth/api-keys

Mint a new API key scoped to the current org. Any org member can mint: keys are operational, not administrative. Minting before the org's KYB is approved is fine. The key just won't authorize gated endpoints (quoting, customer onboarding) until approval lands.

The plaintext secret is returned exactly once in the response. We hash and discard it server-side immediately. There is no "show key" endpoint. If a caller loses it, revoke and mint a new one.

The minted key is implicitly scoped to the environment of the URL you call. There is no environment field in the request body. orchestration.seismictest.net mints a sandbox key (seismic_sandbox_…). orchestration.seismic.systems mints a production key (seismic_prod_…).

Request body

{
  "label": "ci-pipeline",
  "ip_allowlist": [
    "203.0.113.4",
    "10.0.0.0/8"
  ],
  "access": "no_money_movement"
}
FieldTypeRequiredNotes
labelstringyesHuman-readable. 1–80 chars. Used in the dashboard list.
ip_allowliststring[]noCIDR ranges / bare IPs the key may be used from. Omit or pass [] for no restriction. Up to 50 entries. See IP allow-listing.
accessstringnofull (default), no_money_movement or read_only. Fixed for the key's lifetime. See Access levels.

Response 200: see ApiKeyMinted.

{
  "id": "k_2f10…",
  "org_id": "0a2a…",
  "prefix": "seismic_prod_abc12…",
  "label": "ci-pipeline",
  "created_by": "9d11…",
  "created_at": "2026-04-29T15:00:00Z",
  "expires_at": "2026-05-29T15:00:00Z",
  "last_used_at": null,
  "revoked_at": null,
  "ip_allowlist": [
    "203.0.113.4/32",
    "10.0.0.0/8"
  ],
  "access": "no_money_movement",
  "can_revoke": true,
  "secret": "seismic_prod_abc12_3f9d8e0a4b6c2e1d0f8a3b7c5d6e4f2a"
}

Bare addresses come back in normalized CIDR form: 203.0.113.4 is echoed as 203.0.113.4/32.

Errors:

  • 400: invalid label.
  • 400 InvalidRequest: an ip_allowlist entry isn't a valid IP or CIDR, or the list exceeds 50 entries.
  • 400 BothCredsProvided: request had both Api-Key: and Authorization: Bearer.
  • 403 ApiKeyAccessDenied: the calling key's access is not full. Only full keys and dashboard sessions can mint keys.

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY" \
  -H "content-type: application/json" \
  -d '{ "label": "ci-pipeline", "ip_allowlist": ["203.0.113.4", "10.0.0.0/8"] }'

Or via dashboard session, e.g. when minting the very first key for an org:

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys" \
  -H "Authorization: Bearer $SEISMIC_DASHBOARD_TOKEN" \
  -H "content-type: application/json" \
  -d '{ "label": "ci-pipeline" }'