Audience: application and coding agent.
Canonical metadata
requestIdtraceparent
Example request
POST /v1/api_keys is a dashboard/control-plane operation. Use a WorkOS browser-session bearer token with api_keys:manage permission to create the key. After creation, use the returned secret as the x-api-key header for REST, SDK, CLI, and server-to-server MCP requests. The secret is revealed exactly once; later list responses return metadata and prefix only.Example response
Give this prompt to your agent
Failure posture
- treat non-2xx responses as contract-aware failures, not free-form errors
- preserve
requestIdandtraceparentin logs and downstream reports - if provenance or freshness metadata is present, return it unchanged so trust is not lost in the handoff

