Create a new API key with specific permission scopes.
Request Body
A descriptive name for the key (e.g., production-backend, ci-pipeline).
Optional ISO 8601 expiration date. Key is valid indefinitely if omitted.
Available Scopes
| Scope | Description |
|---|
environments:read | List and retrieve environments |
environments:write | Create, update, delete environments |
files:read | List, retrieve, and download files |
files:write | Upload and delete files |
members:read | List environment members |
members:write | Add, update, remove members |
publishers:read | Read publisher configuration |
publishers:write | Create, update, delete publishers |
aggregators:read | Read aggregator configuration |
aggregators:write | Update, delete aggregators |
secrets:read | Read secrets |
secrets:write | Create, update, delete secrets |
account:read | Read account info and usage |
Response
The API key value. Only returned once — store it securely.
Expiration timestamp, or null.
ISO 8601 creation timestamp.
Example
curl -X POST https://api.tusky.io/v2/api-keys \
-H "Api-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production-backend",
"scopes": ["files:read", "files:write", "environments:read"]
}'
Response
{
"id": "key_abc123",
"key": "tsk_live_xK9m2...",
"name": "production-backend",
"scopes": ["files:read", "files:write", "environments:read"],
"expiresAt": null,
"createdAt": "2026-03-07T14:00:00Z"
}
The key value is only returned in this response. Store it securely — you cannot retrieve it again.