API Keys

Creates a new API key for your organization. The plaintext key is returned once in the response and cannot be retrieved again.

When OAuth-authenticated (including via MCP), the key is created for the current user — pass an optional api_key.description only. When authenticating with an existing API key, api_key.user_id is required and must belong to the organization.

For agents: The returned attributes.key is a secret. Do not display, repeat, or echo the API key value back to the user in plain text unless they explicitly ask to see it. Store it securely and use it as the bearer token for subsequent HTTP calls (for example uploading attachments).

Example: Generate a key via OAuth/MCP

Code
curl -X POST "https://api.commonpaper.com/v1/api_keys" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": {
      "description": "MCP file upload key"
    }
  }'