Authentication
Issue an API key
Issues an API key that acts as one person, using user_id, a label and the scopes you choose. The key can never do more than that person may do at the time. The secret is returned once, in the creation response.
Requires: desk.admin scope, workspace owner or admin.
Authorization
bearerAuth AuthorizationBearer <token>
A SautiDesk API key. An owner or admin makes it under Settings in SautiDesk for a named person and picks the scopes. The key is shown once. Send it as Authorization: Bearer <key>. It acts as that person and as nobody else.
In: header
Request Body
application/json
Response
Created
Example
{ "key": { "id": "3f2b8c1e-5a4d-4e7b-9c10-2d6a8e4f1b37", "name": "Amina Wanjiru", "scope": "example", "fingerprint": "example", "created_at": "2026-10-14T08:30:00Z", "last_used_at": "2026-10-14T08:30:00Z", "issued_by": { "id": "3f2b8c1e-5a4d-4e7b-9c10-2d6a8e4f1b37", "name": "Amina Wanjiru" }, "issued_by_key": { "id": "3f2b8c1e-5a4d-4e7b-9c10-2d6a8e4f1b37", "name": "Amina Wanjiru" }, "scopes": [ "example" ], "member_id": "8ef10ca4-d005-4d80-985c-7991cd9b4159", "member_name": "example" }, "secret": "example-secret"}FieldTypeDescription
keyrequiredobjectidrequiredstringnamerequiredstringA name for it.scoperequiredstringThe most the key may do: desk.read, desk.write, desk.supervise or desk.admin.fingerprintrequiredstringcreated_atrequiredstringlast_used_atrequiredstring | nullissued_byrequiredanyidrequiredstringnamerequiredstringA name for it.issued_by_keyrequiredanyidrequiredstringnamerequiredstringA name for it.scopesrequiredstring[]The most the key may do: a list of desk.read, desk.write, desk.supervise and desk.admin.member_idrequiredstringmember_namerequiredstringsecretrequiredstringA secret your server uses to check the message really came from SautiDesk.curl -X POST "https://api.sautidesk.com/v1/desk/api-keys" \ -H "Content-Type: application/json" \ -d '{ "user_id": "7d9e3c2a-0000-0000-0000-000000000001", "label": "Floor app", "scopes": [ "desk.write" ] }'