social.coves.aggregator.createApiKey

coves.social

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Create an API key for the authenticated aggregator. Requires OAuth authentication. The API key is returned ONCE and cannot be retrieved again. Store it securely.",
      "errors": [
        {
          "description": "OAuth authentication is required to create an API key",
          "name": "AuthenticationRequired"
        },
        {
          "description": "OAuth session is required (not service JWT) to create an API key",
          "name": "OAuthSessionRequired"
        },
        {
          "description": "Only registered aggregators can create API keys",
          "name": "AggregatorRequired"
        },
        {
          "description": "Failed to generate the API key",
          "name": "KeyGenerationFailed"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "description": "No input required. The key is generated server-side for the authenticated aggregator.",
          "properties": {},
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "createdAt": {
              "description": "ISO8601 timestamp when the key was created",
              "format": "datetime",
              "type": "string"
            },
            "did": {
              "description": "DID of the aggregator that owns this key",
              "format": "did",
              "type": "string"
            },
            "key": {
              "description": "The plain-text API key. This is shown ONCE and cannot be retrieved again. Format: ckapi_<64-hex-chars> (32 bytes hex-encoded)",
              "maxLength": 256,
              "type": "string"
            },
            "keyPrefix": {
              "description": "First 12 characters of the key (e.g., 'ckapi_ab12cd') for identification in logs and UI",
              "maxLength": 64,
              "type": "string"
            }
          },
          "required": [
            "key",
            "keyPrefix",
            "did",
            "createdAt"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "social.coves.aggregator.createApiKey",
  "lexicon": 1
}

Validate Record

Validate a record against social.coves.aggregator.createApiKey

Validation Options
Treat any remaining unresolved references as valid

Metadata

DID
did:web:coves.social
CID
bafyreidoiqxrzksd757a573evwmtxwxu4soswudu56veai2l3pzfvwb7xm
Indexed At
2026-07-24 05:18 UTC
AT-URI
at://did:web:coves.social/com.atproto.lexicon.schema/social.coves.aggregator.createApiKey

Similar Lexicons

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • Mint a new cocore API key for the authenticated account. Authenticate with either a console session cookie or an existing `Authorization: Bearer cocore-...` key. The full secret is returned exactly once in `secret` and …

  • Get information about the authenticated aggregator's API key. Note: The actual key value is NEVER returned - only metadata about the key.

  • Revoke the authenticated aggregator's API key. After revocation, the aggregator must complete OAuth flow again to create a new API key. This action cannot be undone.

  • List every API key belonging to the authenticated account, most-recently-created first. The owning DID is derived from the credential presented (session cookie or `Authorization: Bearer cocore-...`); there is no way to …

Lexicon Garden

@