Create Account Key
Create an account key for your active account: an API key that belongs to the account, not to a person, for CI and other automation. It acts only in this account, with exactly the role you give it, and keeps working when you leave the account.
The full key is in the response and is never shown again: store it the moment you receive it, for example as a CI secret. Send it in the X-API-KEY header, like any API key.
Who can create one
The members:write permission on the active account, from a dashboard session or with your own API key (ngk_). You can't give a key more access than you have: a role with a permission you don't hold is refused. The account owner can give any role.
An account key can't create keys (403, account_key_not_allowed), and neither can an OAuth session such as the MCP server's browser sign-in. The account's plan must include account keys and allow one more active key.
Request body
. ' - _ ( ) ! ? : , + &, for example "GitHub Actions deploy". Shown in the list and in the audit log.ngris deploy), the role needs endpoints read and write.1-3650. The dashboard suggests 90."2027-06-30T23:59:59Z"): in the future, at most 10 years ahead. Send expires_in_days or expires_at, not both. Without either the key never expires."203.0.113.10, 198.51.100.0/24"). A request from any other address answers 401. Empty: any address.Expiry and the allowed IPs can't be changed later, and neither can the role: create a new key, then revoke the old one. Unknown fields are refused.
Response (201 Created)
nak_ followed by 40 characters (letters, digits, _ and -).uuid, name, role, hint, created_at, created_by, last_used_at, expires_at, allowed_ips, status).Creating a key is recorded in the account's audit log under your name: Account key <name> created with role <role>.
Errors
name, or one with other characters, a missing or malformed role_uuid, both expiry fields, an expiry out of range, an address that isn't an IP or CIDR range, or an unknown field. Field errors carry fields, for example {"error": "expires_in_days must be 1-3650", "fields": {"expires_in_days": "Use 1-3650 days."}}.members:write; the role has a permission you don't hold (permission_ceiling); the plan doesn't include account keys, or custom roles for a custom role (entitlement_required); the account has as many active keys as its plan allows (limit_reached); the request uses an account key (account_key_not_allowed) or an OAuth session; the account is suspended (account_suspended).role not found: no such role in the active account.