Sign-up and API keys are open. Paid top-ups open soon.What changed
thinQit Dex
NL
Docs menu

API reference, Console keys

Create an API key

View as Markdown

POST/v1/console/keysoperation id createKey

The response is the only time the full secret is shown. Store it at once.

Authentication. Console session cookie (__Host-dex_session). State-changing routes also need the x-dex-csrf header.

Parameters

x-dex-csrfheader ยท stringrequired
The csrf_token returned by createSession. Required on every state-changing console route.
  • 32 to 64 characters

Request body

application/json, schema CreateKeyRequest

namestringrequired
  • 1 to 64 characters
modestringrequired
  • one of "live", "test"
scopesarray of Scope
Defaults to all scopes.
  • at least 1 items
  • unique items
  • each item: one of "decide", "usage:read", "balance:read"
expires_atstring | null
  • format date-time
limitsKeyLimits
  • no other fields
limits.requests_per_minuteinteger
  • 1 to 600
limits.tokens_per_minuteinteger
  • 1,000 to 600,000
limits.concurrencyinteger
  • 1 to 32

Responses

201Key created.

Headers: x-request-id

idKeyIdrequired
  • pattern ^key_[0-9A-HJKMNP-TV-Z]{26}$
objectstringrequired
  • always "api_key"
namestringrequired
modestringrequired
  • one of "live", "test"
prefixstringrequired
The mode prefix plus the first 4 characters, for recognising the key.
  • pattern ^dex_(live|test)_[0-9A-Za-z]{4}$
scopesarray of Scoperequired
  • each item: one of "decide", "usage:read", "balance:read"
limitsKeyLimitsrequired
  • no other fields
limits.requests_per_minuteinteger
  • 1 to 600
limits.tokens_per_minuteinteger
  • 1,000 to 600,000
limits.concurrencyinteger
  • 1 to 32
created_atstringrequired
  • format date-time
last_used_atstring | nullrequired
  • format date-time
expires_atstring | nullrequired
  • format date-time
revoked_atstring | nullrequired
  • format date-time
secretstringrequired
The full key, with its checksum (see the ApiKeyAuth scheme). Shown only in this response.
  • pattern ^dex_(live|test)_[0-9A-Za-z]{40}$
400The request could not be read. Codes: invalid_json (not JSON, not UTF-8, or a \u escape that is half of a surrogate pair, such as "\ud800" without its low half), duplicate_key (a JSON object repeats a key; param is the JSON pointer of the repeated member, such as /questions/q1/options/a), unsupported_media_type (not application/json) and invalid_header (a malformed idempotency-key or x-client-request-id; param names the header).

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

401Missing, unknown, revoked or expired credentials.

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

403The credentials are valid but not allowed to do this (missing scope, suspended account or failed CSRF check).

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

422The request is well-formed JSON but breaks a validation rule. param names the field as a dotted path. Codes: unknown_field, missing_field, invalid_type (wrong JSON type), invalid_value (right type, value out of range: an empty or over-long string, a state, instructions, criteria string or option description of only whitespace, an empty questions or options object, an empty state object or array, a pattern or allowed-value mismatch such as a label or level with outer whitespace, a state nested deeper than 32 levels, a bad date or date range), field_not_allowed (options or levels on the wrong question type), invalid_question_id, too_many_questions, too_many_options, invalid_levels (including two levels equal after Unicode NFC normalisation and lower-casing), invalid_min_confidence, duplicate_label (two option labels equal after Unicode NFC normalisation and lower-casing, such as Billing and billing), state_path_not_found, state_not_json and, on the console, top_up_limit_exceeded.

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

429A rate limit or quota is exhausted. Retry after the given number of seconds. For test_daily_quota that is the time until 00:00 UTC; clients should not retry it automatically.

Headers: x-request-id, x-client-request-id, retry-after, ratelimit-policy, ratelimit

Error envelope. See Errors for every type and code.

500An unexpected error. Any charge was refunded. Retry with the same idempotency key.

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

503maintenance: the console's database, sign-in or payments are unavailable for a moment. Retry after retry-after. Nothing was changed.

Headers: x-request-id, retry-after

Error envelope. See Errors for every type and code.

Examples

Illustrative values. Examples show the shape of requests and responses; the numbers in them are not measured results.

Request: ciKey

{
  "name": "ci-pipeline",
  "mode": "test",
  "scopes": [
    "decide"
  ]
}

Response: A new test key; the secret appears only here

{
  "id": "key_01M5CJXQ3A8F2T6W1B9N4H7K0M",
  "object": "api_key",
  "name": "ci-pipeline",
  "mode": "test",
  "prefix": "dex_test_R4tv",
  "scopes": [
    "decide"
  ],
  "limits": {
    "requests_per_minute": 30,
    "tokens_per_minute": 40000,
    "concurrency": 4
  },
  "created_at": "2026-10-20T12:01:00Z",
  "last_used_at": null,
  "expires_at": null,
  "revoked_at": null,
  "secret": "dex_test_R4tvW8pLq2ZkN6sYb3HdJ9cXf1MgTa5E0u422oNf"
}