Skip to main content

Create API key

POST 
/v2/config/admin/apikey

Creates an API key for the organisation. Use the key to call the OID4VCI and OpenID4VP endpoints from a server, in place of a bearer access token. Send the key as Authorization: ApiKey <apiKey>.

Give the key the scopes that it needs. The config scope opens the configuration endpoints of the digital wallet, such as credential definitions, presentation definitions, webhooks and keys. The service refuses any scope other than config, audit, service and onboard with HTTP 400.

The response holds the token in full, in the apiKey field. This is the only moment at which you can copy it from a create response, so keep it in a safe place.

To bind the key to a sandbox organisation instead of the main wallet, send the identifier of the sandbox organisation in the sandboxOrgId field of the body. This field is the only way to bind a key at creation; the X-SandboxOrgId header has no effect on this operation. The sandbox organisation must belong to your organisation and must be deployed.

Request​

Body

required

The API key to create.

    apiKey objectrequired

    The API key to create.

    name string

    Name of the API key. Use it to tell your keys apart.

    scopes string[]required

    Possible values: [config, audit, service, onboard]

    Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400. Use config for the OID4VCI and OpenID4VP configuration endpoints.

    expiryInDays integer

    Default value: 30

    Lifetime of the API key in days, counted from the moment of creation. The service uses 30 days when you leave this field out, or when you send 0 or a negative value.

    sandboxOrgId string

    Identifier of the sandbox organisation to bind the API key to. Leave the field out, or send an empty string, to bind the key to the main wallet of the organisation. The sandbox organisation must belong to your organisation and must be deployed; if it does not, the service gives HTTP 400.

Responses​

The service created the API key. This operation returns 200, not 201. The apiKey field of the returned object holds the signed token.

Response Headers
    Schema
      apiKey objectrequired

      The API key that the service created.

      id stringrequired

      Unique identifier of the API key.

      name stringrequired

      Name of the API key. The service does not check this value for uniqueness.

      scopes string[]required

      Possible values: [config, audit, service, onboard]

      Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400.

      apiKey stringrequired

      The signed JSON Web Token. Send it as Authorization: ApiKey <apiKey>. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.

      expiryInDays integerrequired

      Default value: 30

      Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send 0 or a negative value.

      timestamp date-timerequired

      Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.

      expiryTimestamp date-timerequired

      Moment when the API key expires, in UTC.

      type stringrequired

      Possible values: [igrantio, aip10]

      Type of the API key. The list operation returns only keys of type igrantio; these are the keys that you create with this group of operations.

      sandboxOrgId string

      Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation.

      createdBy objectrequired

      The user who created the API key, and the moment of creation. The service keeps this as log metadata.

      id stringrequired

      Identifier of the user who created the API key. The value is an empty string for a key created with an API key.

      email stringrequired

      Email address of the user who created the API key.

      at date-timerequired

      Moment of creation, in UTC.

    Loading...
    Last updated on