Create an API key
Issues an API key for the service account and returns its secret token (cbk_…). The token is in this response only; listings show only hint, its first 12 characters (see The key is shown once). Send it directly as Authorization: Bearer cbk_….
namemust be unique among the service account's keys that are not revoked, expired ones included.scopeisreadorwrite. Areadkey may call onlyGETroutes; awritekey may call every route that accepts API keys. Either way the key acts as its service account, only inside this organization.expiresInDays: the key stops working that many days after creation. Without it the key never expires.
The key stops working when it is revoked or expires, or when its service account is deleted, not when the person who created it leaves the organization.
Only the organization's owners and admins may call this route, with a sign-in session; API keys are refused.
sessionAuthorizationBearer <token>A sign-in session token (jvs_…) from the Dashboard, cubicle login or the device authorization flow.
org*stringThe organization's ID or name. An organization where the caller is not an active member returns 404.
account*stringThe service account's ID, or its NAME without the organization (ci for acme/ci). A UUID is always read as an ID.
application/json- body
name*string^[a-z0-9][a-z0-9._-]{0,62}$scope*string"read""write"expiresInDays?integer1 <= value <= 3650The new key with its token. Store the token now; it is not shown again.
application/json- response
A new API key with its secret token, which only the create call returns.
token*stringThe secret API key (cbk_…), shown only in this response; send it as Authorization: Bearer cbk_….
id*stringThe key's ID, used to revoke it.
name*stringThe key's name, unique among its service account's keys that are not revoked.
scope*ApiKeyScopeWhat the key may call: read allows only GET routes, write every route that accepts API keys.
"read""write"hint*stringThe token's first characters, to recognize it without the secret.
createdBy*The person who created the key; the key keeps working after they leave the organization.
createdAt*stringWhen the key was created (ISO 8601, UTC).
expiresAt*|When the key stops working (ISO 8601, UTC), or null if it never expires.
lastUsedAt*|When the key last authenticated a request (ISO 8601, UTC), or null if it never has.
curl -X POST 'https://api.cubicle.sh/v1/orgs/acme/service-accounts/ci/keys' \ -H 'Content-Type: application/json' \ -d '{ "name": "github-actions", "scope": "write", "expiresInDays": 90}'{ "id": "4b6d8f0a-2c4e-4a6b-8d0f-1a3c5e7b9d2f", "name": "github-actions", "scope": "write", "hint": "cbk_2QwBcGYt", "createdBy": { "id": "2c4e6a8b-0d1f-4e3a-9b5c-7d9f1b3d5e7a", "identity": "ada@example.com" }, "createdAt": "2026-11-01T09:05:00.000Z", "expiresAt": "2027-01-30T09:05:00.000Z", "lastUsedAt": null, "token": "cbk_2QwBcGYt9L6RRRbIV5SxgBf2W3WyiJMDUyq5tuYTW0M"}