Workspace API keys

curl -X POST https://app.onlysocial.io/api/partner/workspaces/$WORKSPACE/api-keys \
  -H "X-API-KEY: $PARTNER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Dealer CRM",
    "scopes": ["salesbot:contacts:read", "salesbot:contacts:write"],
    "expires_at": null
  }'

{
  "success": true,
  "message": "API key created. The token is shown once and cannot be retrieved again.",
  "data": {
    "id": "0b8d6f4e-....",
    "name": "Dealer CRM",
    "prefix": "osk_3fA9",
    "scopes": ["salesbot:contacts:read", "salesbot:contacts:write"],
    "created_at": "2026-10-20T09:15:40+00:00",
    "expires_at": null,
    "revoked_at": null,
    "last_used_at": { "publishing": null, "salesbot": null, "biolinks": null },
    "plain_text_token": "osk_3fA9…"
  }
}

​

Rules

• Same permissions as the dashboard. scopes takes the same list a workspace admin sees. A permission the workspace cannot have, for a feature its plan does not include, is a 422, never silently dropped.
• 25 live keys per workspace, shared with keys made in the dashboard. Revoke an unused one before creating another.
• The key acts as the customer’s admin. It is attributed to the workspace admin you provisioned, and stops working if that person stops being an admin.
• Audited. Every key you issue is written to the customer’s audit log, naming your partner account.

​

List and revoke

• GET /api/partner/workspaces/{workspace}/api-keys lists the workspace’s keys: name, prefix, scopes, dates and last use per API. Never the secret.
• DELETE /api/partner/workspaces/{workspace}/api-keys/{id} revokes a key immediately, for every API. Repeating it returns 200, so retries are safe.