Create an API key

POST/api/keys

Creates an API key for the signed-in user. The response is the only time you see the full key, so store it.

Send Accept: application/json to get the key as JSON. Without it, a request with a session cookie is redirected to /settings, which shows the key once. A request without a session cookie always gets JSON. Available only when sign-in is enabled.

Authorizations

Authorizationstringheaderrequired

Needed only when the instance has sign-in enabled (PULLMD_AUTH_MODE is single-admin or multi-user). Send Bearer pmd_<key> with an API key created at /settings. In single-admin mode, the legacy PULLMD_AUTH_TOKEN is also accepted as a bearer token. OAuth access tokens work only on /mcp. Browser sessions use the pullmd_session cookie instead.

Body

application/x-www-form-urlencoded

Form-encoded. Without a body, the key has no label.

labelstring

A name for the key, shown at /settings. Longer values are cut to 100 characters.

Length: 0–100

Response

200 · application/json

The new key.

keystring

The full API key: pmd_ followed by 32 letters and digits. Send it as Authorization: Bearer <key>.

cURL

curl --request POST \
  --url 'http://localhost:3000/api/keys' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-binary '@file'

{
  "key": "<string>"
}