---
title: Mint a short-lived workspace API key
description: Session-only.
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/api-keys/ephemeral"
canonical_url: https://wiblo.app/docs/developers/api/api-keys/mint-workspace-ephemeral
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/api-keys/mint-workspace-ephemeral.md
---

# Mint a short-lived workspace API key

`POST /v1/workspaces/{workspaceId}/api-keys/ephemeral`

Session-only. Mints an `ephemeral` workspace key with a 1h–24h TTL under the named integration. The raw `access_key` is returned exactly once. Per-workspace rate-limited at 20 mints / hour.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `integration_name` | `string` | Yes |  |
| `role_cap` | `"admin" \| "member"` | Yes |  |
| `ttl_seconds` | `integer` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/api-keys/ephemeral \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "integration_name": "...",
  "role_cap": "admin",
  "ttl_seconds": 0
}'
```

**TypeScript**

```ts
import { createSdk, mintWorkspaceEphemeral } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await mintWorkspaceEphemeral({
  client: sdk,
  path: { workspaceId: "..." },
  body: {
    "integration_name": "...",
    "role_cap": "admin",
    "ttl_seconds": 0
  },
})
```

## Responses

**`201`** — The ephemeral key was minted; `access_key` is shown once. Returns `MintWorkspaceEphemeralResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `access_key` | `string` | Yes |  |
| `id` | `string` | Yes |  |
| `member_id` | `string` | Yes |  |
| `key_prefix` | `string` | Yes |  |
| `expires_at` | `string` | Yes |  |

**`400`** — Body failed Zod validation (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — A `wbl_*` bearer was presented (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — Caller has no active membership in the workspace, or it does not exist (`WORKSPACE_NOT_FOUND`). Returns `ApiErrorEnvelope`.

**`409`** — Another active integration in the workspace already uses this name (`MACHINE_MEMBER_NAME_TAKEN`). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`), `ttl_seconds` is outside 1h–24h (`INVALID_TTL`), or `role_cap` exceeds the caller's effective role (`ROLE_CAP_EXCEEDED`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.