> ## Documentation Index > Fetch the complete documentation index at: https://docs.runaether.dev/llms.txt > Use this file to discover all available pages before exploring further. # Create platform API key > Mints an API key pinned to the organization the path names and returns it with its raw key, shown only this once. Use this tool when you need to: - Give a script, CI job or the Aether CLI a credential that acts as the caller in one organization - Replace a leaked or lost key, after revoking the old one Examples: - POST /orgs/{orgID}/platform-keys {"name": "CI deploys"} - POST /orgs/6f1c2a9e-3b7d-4c55-9a2e-0d8b1f4e7c21/platform-keys {"name": "laptop CLI"} Hints: - orgID is the organization's uuid; a malformed one is refused with 400 before the schema. name is required, 1 to 100 characters with at least one that is not a space, and is stored trimmed; a blank name or one over 100 characters is refused with 422. - Answers 201 with key, aether_ and 64 hex characters, which is never shown again, and prefix, its first 12 characters, which listPlatformKeys shows. - The key acts as the caller, in that organization at the root paths (a path that names an organization acts in that one), with their role there checked on every request; it is deleted with the caller's membership in its organization. - Use listPlatformKeys instead to see existing keys and revokePlatformKey instead to revoke one. - Members with a product role (owner, admin, member) may mint one, with a session-authenticated sign-in: an API key or a JWT without a session is refused with 403 session_auth_required, a viewer or billing member with 403 org_role_insufficient, and a non-member with 403 org_membership_required. ## OpenAPI ````yaml api-reference/openapi.json POST /orgs/{orgID}/platform-keys openapi: 3.1.0 info: title: Aether API version: 0.1.0 servers: - url: https://api.runaether.dev security: - bearerAuth: [] paths: /orgs/{orgID}/platform-keys: post: tags: - platform-keys summary: Create platform API key description: >- Mints an API key pinned to the organization the path names and returns it with its raw key, shown only this once. Use this tool when you need to: - Give a script, CI job or the Aether CLI a credential that acts as the caller in one organization - Replace a leaked or lost key, after revoking the old one Examples: - POST /orgs/{orgID}/platform-keys {"name": "CI deploys"} - POST /orgs/6f1c2a9e-3b7d-4c55-9a2e-0d8b1f4e7c21/platform-keys {"name": "laptop CLI"} Hints: - orgID is the organization's uuid; a malformed one is refused with 400 before the schema. name is required, 1 to 100 characters with at least one that is not a space, and is stored trimmed; a blank name or one over 100 characters is refused with 422. - Answers 201 with key, aether_ and 64 hex characters, which is never shown again, and prefix, its first 12 characters, which listPlatformKeys shows. - The key acts as the caller, in that organization at the root paths (a path that names an organization acts in that one), with their role there checked on every request; it is deleted with the caller's membership in its organization. - Use listPlatformKeys instead to see existing keys and revokePlatformKey instead to revoke one. - Members with a product role (owner, admin, member) may mint one, with a session-authenticated sign-in: an API key or a JWT without a session is refused with 403 session_auth_required, a viewer or billing member with 403 org_role_insufficient, and a non-member with 403 org_membership_required. operationId: createPlatformKey parameters: - in: path name: orgID required: true schema: format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreatePlatformKeyRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreatePlatformKeyResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/PlatformKeysErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/PlatformKeysErrorResponse' description: Unauthorized '403': content: application/json: schema: anyOf: - $ref: '#/components/schemas/SessionAuthRequiredErrorResponse' - $ref: '#/components/schemas/OrgAuthorizationErrorResponse' description: Forbidden '422': content: application/json: schema: $ref: '#/components/schemas/PlatformKeysErrorResponse' description: Unprocessable Entity '500': content: application/json: schema: $ref: '#/components/schemas/PlatformKeysErrorResponse' description: Internal Server Error components: schemas: CreatePlatformKeyRequest: additionalProperties: false properties: name: maxLength: 100 minLength: 1 pattern: \S type: string required: - name type: object CreatePlatformKeyResponse: additionalProperties: false properties: created_at: format: date-time type: string id: format: uuid type: string key: minLength: 1 type: string last_used_at: format: date-time type: - string - 'null' name: minLength: 1 type: string org_id: format: uuid type: string org_name: minLength: 1 type: string prefix: minLength: 1 type: string revoked_at: format: date-time type: - string - 'null' user_id: format: uuid type: string required: - key - id - user_id - org_id - org_name - name - prefix - created_at - last_used_at - revoked_at type: object PlatformKeysErrorResponse: additionalProperties: false properties: code: enum: - bad_gateway - bad_request - conflict - forbidden - gateway_timeout - gone - internal_error - method_not_allowed - not_acceptable - not_found - not_implemented - payment_required - precondition_failed - rate_limited - request_canceled - request_timeout - request_too_large - service_unavailable - session_auth_required - unauthenticated - unsupported_media_type - validation_failed minLength: 1 type: string error: minLength: 1 type: string errors: items: $ref: '#/components/schemas/ErrorDetail' type: array required: - error - code type: object SessionAuthRequiredErrorResponse: additionalProperties: false properties: code: enum: - session_auth_required type: string error: minLength: 1 type: string required: - error - code type: object OrgAuthorizationErrorResponse: additionalProperties: false properties: code: enum: - org_membership_required - org_role_insufficient - org_suspended - account_deleting - agent_host_route_not_allowed - credential_kind_not_admitted type: string error: minLength: 1 type: string required: - error - code type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object securitySchemes: bearerAuth: bearerFormat: JWT scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.