Zernio
Zernio
API Reference

API Keys

List keysGETCreate keyPOSTDelete keyDELETEVerify credentialGET
Dashboard
llms.txtOpenAPI
OverviewPlatformsAPI ReferenceResources
API Keys

Create key

Creates a new API key with an optional expiry. The full key value is only returned once in the response.

POST
/v1/api-keys

Authorization

bearerAuth
AuthorizationBearer <token>

API key authentication: send your Zernio API key in the Authorization header, prefixed with Bearer.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

{  "message": "API key created successfully",  "apiKey": {    "id": "6507a1b2c3d4e5f6a7b8c9d0",    "name": "No Private Messages Key",    "keyPreview": "zrk_12345678...90abcdef",    "key": "zrk_1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",    "expiresAt": null,    "createdAt": "2024-01-15T10:30:00Z",    "scope": "full",    "profileIds": [],    "permission": "read-write",    "disabledResourceGroups": [      "messages",      "contacts",      "webhooks"    ]  }}
Was this page helpful?

List keys

Returns all API keys for the authenticated user. Keys are returned with a preview only, not the full key value.

Delete key

Permanently revokes and deletes an API key.

name*string
expiresIn?integer

Days until expiry

scope?string

'full' grants access to all profiles (default), 'profiles' restricts to specific profiles

Default"full"

Value in

  • "full"
  • "profiles"
profileIds?array<string>

Profile IDs this key can access. Required when scope is 'profiles'.

permission?string

'read-write' allows all operations (default), 'read' restricts to GET requests only

Default"read-write"

Value in

  • "read-write"
  • "read"
disabledResourceGroups?array<>

Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send direct messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own disabledResourceGroups, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.