Create a Signing key
const url = 'https://app.caprid.com/v1/keys';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"label":"backend"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://app.caprid.com/v1/keys \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "label": "backend" }'POST /v1/namespaces/{namespace}/keys for the API key’s only Namespace.
Authorizations
Section titled “Authorizations”Request Body
Section titled “Request Body”object
Becomes part of the kid, which is <namespace>_<label>.
Labels are unique within a Namespace. Defaults to a random
12-character hex string.
A path relative to your Namespace, like room/42. Leading, trailing
and repeated slashes are ignored. Segments can’t be . or .., or
contain whitespace or control characters.
Examples
A key for the whole Namespace
{ "label": "backend"}A key that can only sign tokens that publish under `live`
{ "label": "ingest", "publish": "live"}Responses
Section titled “Responses”The new key, secret included.
A Signing key in JSON Web Key form, with the scope extension moq
relays understand. k is the secret. Anyone holding it can sign
tokens within the scope.
object
The HMAC secret, base64url without padding.
What a Signing key may sign. put is publish and get is subscribe,
as in the token claims. Both are relative to root.
object
Example
{ "alg": "HS256", "key_ops": [ "sign", "verify" ], "kty": "oct", "kid": "acme_backend", "scope": { "root": "acme" }}Sent with a session, or with an API key that doesn’t reach exactly one Namespace. Use the route the message names instead. This route also returns 400 for anything that route would refuse with 400.
object
Example
{ "error": "this API key reaches 2 Namespaces, so this route can't tell which one you mean; use /v1/namespaces/{namespace}/keys"}No valid credential. Missing, expired and revoked credentials all get the same response, and so does an API key whose trial has lapsed. An Agent token from before a claim gets a 401 too, once the claim has made the trial a person’s, with a message saying to get a new token.
object
Example
{ "error": "the requested grants exceed the key's scope"}Headers
Section titled “Headers”Example
Bearer realm="switchboard"Sent with an API key limited to some Namespaces, to a Namespace outside its limit, or to a route that acts on the Organization as a whole. A limited key can never create API keys.
object
Example
{ "error": "this API key is limited to the Namespaces acme-staging, and acme isn't one of them"}The Namespace already has a key with this label.
object
Example
{ "error": "the requested grants exceed the key's scope"}