> ## Documentation Index
> Fetch the complete documentation index at: https://www.papers.bot/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue a scoped workspace API key

> The token is shown only once. Unavailable during impersonation. Required scope: agents:write. Requires a human owner/admin session; agent API keys and delegated OAuth cannot administer the workspace.



## OpenAPI

````yaml /openapi.json post /api-keys
openapi: 3.1.0
info:
  title: Papers API
  version: 0.1.0
  description: >-
    Email, SMS, and workspace resources for Papers. Authenticate resource
    requests with a scoped API key or OAuth token. Administrative endpoints
    require a human session.
servers:
  - url: https://www.papers.bot/v1
security:
  - bearerAuth: []
paths:
  /api-keys:
    post:
      tags:
        - API keys
      summary: Issue a scoped workspace API key
      description: >-
        The token is shown only once. Unavailable during impersonation. Required
        scope: agents:write. Requires a human owner/admin session; agent API
        keys and delegated OAuth cannot administer the workspace.
      operationId: createApiKey
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $schema: https://json-schema.org/draft/2020-12/schema
              type: object
              properties:
                resourceGrants:
                  anyOf:
                    - type: object
                      properties:
                        inboxIds:
                          default: []
                          maxItems: 100
                          type: array
                          items:
                            type: string
                            minLength: 1
                        phoneNumberIds:
                          default: []
                          maxItems: 100
                          type: array
                          items:
                            type: string
                            minLength: 1
                      additionalProperties: false
                    - type: 'null'
                dailyInboxLimit:
                  anyOf:
                    - type: integer
                      minimum: 0
                      maximum: 10000
                    - type: 'null'
                dailyNumberLimit:
                  anyOf:
                    - type: integer
                      minimum: 0
                      maximum: 10000
                    - type: 'null'
                dailyEmailLimit:
                  anyOf:
                    - type: integer
                      minimum: 0
                      maximum: 10000
                    - type: 'null'
                dailySmsLimit:
                  anyOf:
                    - type: integer
                      minimum: 0
                      maximum: 10000
                    - type: 'null'
                name:
                  type: string
                  minLength: 1
                  maxLength: 80
                agentId:
                  type: string
                  minLength: 1
                scopes:
                  minItems: 1
                  type: array
                  items:
                    type: string
                    enum:
                      - agents:read
                      - agents:write
                      - inboxes:read
                      - inboxes:write
                      - email:send
                      - numbers:read
                      - sms:read
                      - numbers:provision
                      - numbers:release
                      - sms:send
                      - events:read
                expiresInDays:
                  default: 90
                  type: integer
                  minimum: 1
                  maximum: 365
              required:
                - name
                - scopes
      responses:
        '200':
          description: Successful JSON response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '201':
          description: Successful JSON response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '429':
          description: >-
            Request rate limit or communication quota exceeded. Rate-limit
            responses include Retry-After.
          headers:
            Retry-After:
              description: >-
                Seconds until the request-rate window resets (rate_limited
                errors)
              schema:
                type: integer
                minimum: 1
                maximum: 60
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Request rejected
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      $schema: https://json-schema.org/draft/2020-12/schema
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            request_id:
              type: string
            retryable:
              type: boolean
            details:
              anyOf:
                - type: object
                  properties:
                    approvalId:
                      type: string
                      minLength: 1
                  required:
                    - approvalId
                  additionalProperties: false
                - type: array
                  items:
                    type: object
                    properties:
                      code:
                        type: string
                      path:
                        type: array
                        items:
                          type:
                            - string
                            - number
                      message:
                        type: string
                    required:
                      - code
                      - path
                      - message
                    additionalProperties: false
          required:
            - code
            - message
            - request_id
            - retryable
          additionalProperties: false
      required:
        - error
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Workspace API key or delegated OAuth access token with /v1 resource
        audience. Administrative routes require the Better Auth browser session
        instead.
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-better-auth.session_token
      description: >-
        Better Auth session with selected organization. Mutations also require
        the trusted Origin header.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.