Create and manage API keys via the meshStack API
preview
Florian Nowarre
As a platform engineer, I want to create, list, and delete meshStack API keys programmatically via the meshStack REST API.
Currently, API keys can only be created through the meshStack UI (Admin Area > Access Control > API Keys). This makes it impossible to automate API key lifecycle management,
which is needed for:
- Automated provisioning of API keys as part of infrastructure-as-code workflows
- Programmatic key rotation for security compliance
- Self-service API key management integrated into CI/CD pipelines
The ephemeral API keys feature (for Building Block runs) covers a narrow use case but
does not allow creating persistent, named API keys with configurable permissions via the API.
Requested capabilities:
- POST endpoint to create a new API key with specified name and permissions
- GET endpoint to list existing API keys
- DELETE endpoint to revoke/delete an API key
- Ability to set permission scopes on creation
Jelle den Burger
marked this post as
preview
The first step towards programmatic API key management is now live in meshStack v2026.19.0:
- New resource type:meshApiKeyis now available as a preview resource in the meshObject API.
- Create and manage keys:Supports listing, creating, and managing API keys via API.
- Permission scoping:New API keys can only receive permissions that are a subset of the calling API key's permissions, preventing privilege escalation.
- Secret returned on creation:TheclientSecretis returned when the key is created or whenexpiresAtchanges — it cannot be retrieved again afterwards, so store it securely.
Note:
This API is in preview and subject to change. We do not recommend relying on it in production workflows until a stable release is available.If you have feedback or questions, reach out to our customer success team or support@meshcloud.io.