> ## Documentation Index
> Fetch the complete documentation index at: https://api.onlysocial.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue an API key

> Creates an `osk_` key for the workspace. `plain_text_token` is returned **once** and cannot be retrieved again. A permission the workspace cannot have is a `422`. At most 25 live keys per workspace, shared with the dashboard.



## OpenAPI

````yaml /api-reference/partner.openapi.json post /partner/workspaces/{workspace}/api-keys
openapi: 3.1.0
info:
  title: Partner API
  version: 1.0.0
  description: >-
    Provision your customers, sign them in with single sign-on, issue their
    workspace API keys and connect their messaging channels. Authenticated by
    your partner key as `X-API-KEY`, from your backend only.
servers:
  - url: https://app.onlysocial.io/api
    description: OnlySocial
security:
  - partnerKey: []
tags:
  - name: Customers
    description: Create or refresh a customer's account and workspace.
  - name: Single sign-on
    description: Swap a token signed with your SSO secret for a one-time sign-in link.
  - name: Workspace API keys
    description: Issue, list and revoke the `osk_` keys of a workspace you provisioned.
  - name: Channel Connect
    description: Hosted links that connect a customer's own messaging channels.
paths:
  /partner/workspaces/{workspace}/api-keys:
    parameters:
      - $ref: '#/components/parameters/Workspace'
    post:
      tags:
        - Workspace API keys
      summary: Issue an API key
      description: >-
        Creates an `osk_` key for the workspace. `plain_text_token` is returned
        **once** and cannot be retrieved again. A permission the workspace
        cannot have is a `422`. At most 25 live keys per workspace, shared with
        the dashboard.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - scopes
              properties:
                name:
                  type: string
                  maxLength: 80
                  example: Dealer CRM
                scopes:
                  type: array
                  minItems: 1
                  items:
                    type: string
                  description: >-
                    [Permissions](/authentication#permissions), as in the
                    dashboard.
                  example:
                    - salesbot:contacts:read
                    - salesbot:contacts:write
                expires_at:
                  type:
                    - string
                    - 'null'
                  format: date-time
                  description: A future time, or `null` for no expiry.
                  example: null
      responses:
        '201':
          description: Issued
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  message:
                    type: string
                    example: >-
                      API key created. The token is shown once and cannot be
                      retrieved again.
                  data:
                    allOf:
                      - $ref: '#/components/schemas/ApiKey'
                      - type: object
                        properties:
                          plain_text_token:
                            type: string
                            description: The secret. Shown once.
                            example: osk_…
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationFailed'
components:
  parameters:
    Workspace:
      name: workspace
      in: path
      required: true
      description: >-
        A workspace uuid from provisioning. It must be administered by a
        customer you provisioned.
      schema:
        type: string
        format: uuid
  schemas:
    ApiKey:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          example: Dealer CRM
        prefix:
          type: string
          description: The first characters of the key, to recognise it.
        scopes:
          type: array
          items:
            type: string
        created_at:
          type: string
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        revoked_at:
          type:
            - string
            - 'null'
          format: date-time
        last_used_at:
          type: object
          properties:
            publishing:
              type:
                - string
                - 'null'
              format: date-time
            salesbot:
              type:
                - string
                - 'null'
              format: date-time
            biolinks:
              type:
                - string
                - 'null'
              format: date-time
    Error:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
        error_code:
          type: string
  responses:
    Unauthenticated:
      description: Missing or invalid partner key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            success: false
            message: Invalid or inactive API key.
    NotFound:
      description: >-
        Not found, or not yours. Another partner's workspace and a uuid that
        does not exist look the same.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ValidationFailed:
      description: A field failed validation.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              message:
                type: string
                example: Validation failed.
              errors:
                type: object
                additionalProperties:
                  type: array
                  items:
                    type: string
  securitySchemes:
    partnerKey:
      type: apiKey
      in: header
      name: X-API-KEY
      description: Your partner API key, `pk_…`. Backend only.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.