Create an auth

Creates a new auth in a gateway.

POST /v1/gateways/{gateway_id}/auths

Error

A valid request URL is required to generate request examples

201

{
  "api_key": "<string>",
  "budget": {
    "max": 123,
    "time_window": "calendar_month",
    "unit": "tokens"
  },
  "config": {
    "mtls": {
      "allowed_common_names": [
        "<string>"
      ],
      "allowed_dns_names": [
        "<string>"
      ],
      "allowed_fingerprints": [
        "<string>"
      ],
      "ca_cert": "<string>"
    },
    "oauth2": {
      "allowed_algorithms": [
        "<string>"
      ],
      "audiences": [
        "<string>"
      ],
      "authorize_url": "<string>",
      "client_id": "<string>",
      "client_secret": "<string>",
      "exchange_client_id": "<string>",
      "exchange_client_secret": "<string>",
      "introspection_url": "<string>",
      "issuer": "<string>",
      "jwks_url": "<string>",
      "login_scopes": [
        "<string>"
      ],
      "public_keys": [
        "<string>"
      ],
      "required_scopes": [
        "<string>"
      ],
      "session_mode": true,
      "subject_claim": "<string>",
      "token_url": "<string>",
      "userinfo_url": "<string>"
    }
  },
  "consumers": [
    {
      "id": "<string>",
      "name": "<string>",
      "slug": "<string>",
      "type": "<string>"
    }
  ],
  "created_at": "<string>",
  "enabled": true,
  "expires_at": "<string>",
  "gateway_id": "<string>",
  "group_id": "<string>",
  "group_name": "<string>",
  "id": "<string>",
  "key_prefix": "<string>",
  "key_suffix": "<string>",
  "name": "<string>",
  "owner_email": "<string>",
  "owner_groups": [
    "<string>"
  ],
  "owner_id": "<string>",
  "type": "<string>",
  "updated_at": "<string>"
}

Authorizations

Authorization · string · header · required

Path Parameters

gateway_id · string<uuid> · required

Gateway id

Body

application/json

Auth to create

config · object

Show child attributes

enabled · boolean

expires_at · string

ExpiresAt retires an api key on its own, as an RFC 3339 instant. Omitted or empty is no expiry, which is what every key was before the field existed.

name · string

type · string

Response

201

application/json

Created

api_key · string

#nosec G101

budget · object

Budget is the spending limit of a personal key. Absent means it has none.

Show child attributes

config · object

Show child attributes

consumers · object[]

Consumers are the consumers this auth reaches, which is what a caller needs before revoking one: a key can be attached to several, so disabling it stops more than the endpoint the reader was looking at. Empty means it reaches none, which is an answer rather than a gap.

Show child attributes

created_at · string

enabled · boolean

expires_at · string

When the key retires itself. Absent means it never does.

gateway_id · string

group_id · string

GroupID is the directory group a group key is held for, which its spend is attributed to. Absent on the owner's personal key and on application keys.

group_name · string

GroupName is GroupID's directory name, which the MCP Store matches the key's access against. Absent wherever GroupID is.

id · string

key_prefix · string

Non-secret recognition hint for api_key auths (e.g. "ag_3dlXk" + "Rv8Q").

key_suffix · string

name · string

owner_email · string

OwnerEmail is the email of a personal key's owner, which the key's calls are shown under. Absent means none was recorded.

owner_groups · string[]

OwnerGroups are the directory groups of a personal key's owner, as the platform last reported them. Absent means none were reported.

owner_id · string

type · string

updated_at · string