API Key

API keys let a server or script call the API as their owner, restricted to the permissions they allow.

📄️ Add Restricted API Key

Issues an API key owned by the authenticated user, in that user's current company, restricted to `allowedPermissions` (at least one) and valid until `expiresAt` (UTC milliseconds, for example now plus 7 days). Requires the `apikey:manage` permission on the authenticated user, and a signed-in user: an API key cannot call this. The response is the only time the key is returned, and the key is not kept in API history. From the CLI, send the response straight into a secret store instead of printing it, for example `terros apikey restricted add ... | jq -r .apiKey | <command that reads the secret from stdin>`. This operation is not offered as a hosted MCP tool, so a key never passes through chat.