VerifiedInbox

API Reference · Account

Create API Key

Create an API key (web session)

POST/v1/api-keys
Account required

Bound to the current environment. The token is shown once.

cURL example

cURL request
curl -X POST "https://api.verifiedinbox.ai/v1/api-keys" \
  -H "Authorization: Bearer vi_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Inc.",
    "scopes": [
      "applications:read"
    ]
  }'

Parameters

ParameterTypeDescription
VI-Environmentheader
string`live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment.

Request body

application/json · required
FieldTypeDescription
namerequired
string—
scopesoptional
string[]

Default: all scopes.

Allowed: applications:read, applications:write, billing:write, certificates:write, support:write

Example request payload (ApiKeyCreateRequest)
{
  "name": "Acme Inc.",
  "scopes": [
    "applications:read"
  ]
}

Response

201 OKCreated.
application/json
FieldTypeDescription
api_keyrequired
ApiKey—
Nested fields (8)
  • created_at (string (date-time))
  • environment (string)
  • id (string (uuid))
  • last_used_at (string (date-time))
  • name (string)
  • prefix (string): First characters of the token, for recognition.
  • revoked_at (string (date-time))
  • scopes (string[])
tokenrequired
string

`vi_live_…`/`vi_test_…` — shown once.

Example 201 response (ApiKeyCreated)
{
  "api_key": {
    "created_at": "2026-10-31T12:00:00Z",
    "environment": "live",
    "id": "0192a5e0-1234-7000-8000-000000000001",
    "last_used_at": "2026-10-31T12:00:00Z",
    "name": "Acme Inc.",
    "prefix": "string",
    "revoked_at": "2026-10-31T12:00:00Z",
    "scopes": []
  },
  "token": "string"
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
401 (unauthenticated)`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

Example 401 error response
{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}
422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
Was it helpful?