Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

  • a Bifrost management API key,
  • a dashboard session token issued by POST /api/session/login,
  • base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Body

application/json

Create virtual key request

name
string
required
description
string
provider_configs
object[]

Provider configurations (empty means no providers allowed, deny-by-default)

mcp_configs
object[]

MCP configurations (empty means no MCP tools allowed, deny-by-default)

team_id
string
customer_id
string
budgets
object[]

Budget quotas assigned directly to this virtual key

rate_limit
object

Create rate limit request

is_active
boolean
calendar_aligned
boolean
default:false
expires_at
string<date-time>

Optional expiry timestamp. Must be in the future. Omit for a key that never expires.

Response

Virtual key created successfully

Virtual key operation response

message
string
required
virtual_key
object
required

Virtual key configuration