FruxonDocs
UsersAPI Access

Generate a new API key

Creates a new API key with the specified permissions. The full key secret is only returned once in this response - store it securely.

POST
/v1/tenants/{tenant}/tokens:generate

Authorization

Bearer
AuthorizationBearer <token>

JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.

In: header

Path Parameters

tenant*string

The tenant identifier

Request Body

The API key configuration

name?string|null

Gets or sets the name of the API key. This helps in identifying the purpose of the key.

expirationDays?integer|null

Gets or sets the number of days before the API key expires. If set to null, the key will never expire. If set to a positive integer, the key will expire after the specified number of days.

Formatint32
type?string

Specifies the type/origin of an API key.

The value tags how the key was created, which the dashboard uses to group + filter the API-keys table (e.g. "show only CLI sessions"). Wire form is UPPER_SNAKE per project convention.

Value in"UNSPECIFIED" | "USER" | "CLI" | "SYSTEM" | "SERVICE_ACCOUNT"
scopes?|null

Explicit scope list. Each entry must be a known scope from Fruxon.Model.Tokens.TokenScopes.AllScopes; unknown values cause the request to 400 with the offending strings listed. Combined (unioned) with the expansion of Fruxon.Model.Tokens.GenerateTokenRequest.Preset when both are supplied — that lets callers say "the runner preset plus one extra scope I need" without having to enumerate the whole preset by hand.

preset?string|null

Named preset (sugar for a scope list). One of runner, builder, read-only, admin. Expanded at mint time; the preset name itself is never stored — only the expanded scope array — so a preset definition change tomorrow doesn't retroactively widen permissions on keys minted today.

[key: string]?never

Response Body

curl -X POST "https://api.fruxon.com/v1/tenants/string/tokens:generate" \  -H "Content-Type: application/json" \  -d '{}'
{
  "id": "string",
  "name": "string",
  "token": "string",
  "keyPrefix": "string",
  "scopes": [
    "string"
  ],
  "createdAt": 0,
  "expiresAt": 0,
  "type": "USER",
  "createdBy": "string"
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
Empty
Empty

Revoke a token

Permanently revokes a token — terminal and irreversible. Any request using it immediately starts returning 401. The row is retained so the audit and request-activity history survive. To temporarily suspend access, suspend the owning principal (e.g. the service account) instead — a token cannot be paused and re-enabled.

Rotate an API key

Mints a replacement key that inherits the original's scopes, name, and type by default, then revokes the original. Pass optional overrides in the request body to narrow / widen scopes, rename the key, or change its lifetime in the same call — fields you omit inherit from the original. The full key secret of the new key is only returned once in this response — store it securely and update wherever the old key was wired.