oz0 apikey create
For: Operators and developers looking up a command.
Make a key that an app sends as Authorization: Bearer <key> to the runtime API, on the edge's HTTPS port. It has a role in one tenant: reader follows jobs, operator also starts and cancels them and decides approvals, and admin also changes the tenant's nodes, rollouts and kill switches. Operators and admins see what jobs read and wrote unless --no-content.
Besides the runtime API, a key works on the operators' MCP endpoint, https://<management>/admin/mcp, with its role there; it works nowhere else: not on the admin API itself, and not on Temporal's ports. It is shown only now; keep it as a secret.
--scope limits a reader or operator key to resources of its tenant: agent:<name> and flow:<name> (start, read, list, watch and decide approvals of their jobs), conversation:own (read the conversations it started). A scoped key is refused everything else, on every call that does not check scopes, and on the operators' MCP endpoint. Without --scope a key reaches the whole tenant. What a key creates (jobs, conversations, budget requests) is labelled with it (created_via).
--admin makes an admin key instead: a key of the admin API, on the management port, with the permissions --permission names (oz0 roles list shows the vocabulary) in one tenant, for a tool such as a usage exporter (--permission usage.export) or an automation. Each permission must be one you hold; it never holds members.manage, signin.manage, governance.relax, keys.manage or changes.review. Only the tenant's owners make one. --expires is required, at most 90d.
Its use, revocation and expiry are in the audit log. It works on the admin API and the operators' MCP endpoint, never on the runtime API. --content lets it see what jobs read and wrote, if you may.
Usage
oz0 apikey create <name> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--admin | bool | make an admin key of the admin API, with --permission instead of a role (needs --expires) | |
--content | bool | an admin key that may see what jobs read and wrote | |
--expires | string | 90d | how long it lasts, such as 30d or 720h, or never |
--json | bool | print JSON instead of a table | |
--no-content | bool | an operator key that may not see what jobs read and wrote | |
--permission | stringArray | an admin key's permission, such as usage.export; repeat for more | |
--role | string | operator | reader, operator or admin |
--scope | stringArray | limit the key to agent:<name>, flow:<name> or conversation:own; repeat for more | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.