Environment API key

An environment API key is a standard WorkOS secret key scoped to a single environment. A platform uses it to configure the environment through the public API, the same way any WorkOS customer would.

The value is returned only in the create response. No endpoint returns it again, so store it encrypted or write it straight into the app’s secrets.

{
  "object": "key",
  "id": "api_key_01K4E21A6ZRE7VWNM4776S0JA9",
  "name": "Platform provisioning key",
  "expires_at": null,
  "value": "sk_example_123456789",
  "created_at": "2026-01-15T06:37:41.193Z",
  "updated_at": "2026-01-15T06:37:41.193Z"
}

• Create an API key
• Expire an API key

Creates an environment-scoped API key. The value in the response is the only time the full key is returned.

curl --request POST \
  --url "https://api.workos.com/platform/teams/team_01K4BN3VKH8AFZC5J334QZY3PM/environments/environment_01K4E21A6ZRE7VWNM4776S0JA9/api_keys" \
  --header "Authorization: Bearer $PLATFORM_ACCESS_TOKEN" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "name": "Platform provisioning key",
        "expires_at": null
    }
BODY

{
  "object": "key",
  "id": "api_key_01K4E21A6ZRE7VWNM4776S0JA9",
  "name": "Platform provisioning key",
  "expires_at": null,
  "value": "sk_example_123456789",
  "created_at": "2026-01-15T06:37:41.193Z",
  "updated_at": "2026-01-15T06:37:41.193Z"
}

• 403 (platform_not_authorized): the platform isn’t authorized on this team.
• 404 (environment_not_found): no such environment in this team.

Expires an API key the calling platform created, and returns 204 No Content.

Setting a future expires_at rotates a key with a grace period: mint the replacement, deploy it, then expire the old key on a date the app has already moved past. Expiring an already-expired key succeeds and changes nothing, so retries are safe.

curl --request POST \
  --url "https://api.workos.com/platform/teams/team_01K4BN3VKH8AFZC5J334QZY3PM/environments/environment_01K4E21A6ZRE7VWNM4776S0JA9/api_keys/api_key_01K4E21A6ZRE7VWNM4776S0JA9/expire" \
  --header "Authorization: Bearer $PLATFORM_ACCESS_TOKEN" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "expires_at": "2026-06-01T00:00:00Z"
    }
BODY

• 409 (expires_at_cannot_be_extended): the key already has an earlier expiration. Expiration can only move closer, never further out.
• 422 (expires_at_too_far_in_future): expires_at is more than 30 days out.
• 404 (key_not_found): no such key in this environment, or the calling platform didn’t create it.