api.apiKeys.mint

Mint a new API key for the current org. Any member can mint. See the REST docs for the permission model and KYB interaction. The plaintext secret is returned exactly once. Store it immediately.

const key = await api.apiKeys.mint({
  label: "ci-pipeline",
  ip_allowlist: ["203.0.113.4", "10.0.0.0/8"], // optional, omit for no restriction
  access: "read_only", // optional, defaults to "full"
});
console.log(key.secret); // "seismic_prod_…"; display, copy, then drop the variable.

Pass ip_allowlist (CIDR ranges or bare IPs) to restrict where the key may be used from. Omit it for an unrestricted key. See IP allow-listing.

Pass access ("full", "no_money_movement" or "read_only") to limit what the key may do. It defaults to "full" and cannot be changed after minting. See Access levels.

The minted key is implicitly scoped to the client's environment: SeismicOrchestrationClient.sandbox() mints sandbox keys, SeismicOrchestrationClient.production() mints production keys.

Returns: Promise<ApiKeyMinted>, the key metadata plus the plaintext secret.

Throws: ApiError 400 (invalid label or ip_allowlist entry), 400 BothCredsProvided, 403 ApiKeyAccessDenied (the calling key is not full).

REST endpoint: POST /auth/api-keys.