> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guild.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint an API-key credential for a workspace agent

> Requires `integrations:write` and `workspaces:read` -- the route resolves the workspace agent before anything else, so a key missing `workspaces:read` gets `404` rather than reaching the scope check.



## OpenAPI

````yaml /api-reference/openapi.yaml post /workspace_agents/{workspace_agent_id}/credentials/api-key
openapi: 3.0.3
info:
  title: Guild Public API
  version: 1.0.0
  description: >-
    The Guild public API, served at https://api.guild.ai/v1 and authenticated
    with account API keys (HTTP Basic, key id as the username and the secret as
    the password). See https://docs.guild.ai/api-reference/introduction for
    scopes and behavior. A session-events websocket also exists at
    wss://api.guild.ai/v1/sessions/{session_id}/events/ws with the same Basic
    auth on the handshake; OpenAPI cannot describe websockets, so it is not
    listed in paths.
servers:
  - url: https://api.guild.ai/v1
    description: Production
security: []
tags:
  - name: accounts
  - name: agents
  - name: sessions
  - name: skills
  - name: workspaces
paths:
  /workspace_agents/{workspace_agent_id}/credentials/api-key:
    post:
      tags:
        - workspaces
      summary: Mint an API-key credential for a workspace agent
      description: >-
        Requires `integrations:write` and `workspaces:read` -- the route
        resolves the workspace agent before anything else, so a key missing
        `workspaces:read` gets `404` rather than reaching the scope check.
      operationId: connect_workspace_agent_api_key
      parameters:
        - name: workspace_agent_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: owner_id
          in: query
          required: true
          schema:
            title: Owner Id
            type: string
        - name: auth_config_id
          in: query
          required: true
          schema:
            title: Auth Config Id
            type: string
        - name: event_id
          in: query
          required: false
          schema:
            default: null
            title: Event Id
            nullable: true
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialAssociation'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - apiKey: []
components:
  schemas:
    CredentialAssociation:
      type: object
      properties:
        id:
          type: string
          format: uuid
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        auth_config_id:
          type: string
          format: uuid
          description: Integration auth config this row applies to
        created_by_id:
          type: string
          format: uuid
          description: The user or API key that granted this credential to the agent.
        target_id:
          type: string
          format: uuid
          description: >-
            Workspace agent install receiving the credential; the association is
            scoped to this install's workspace. Account-wide availability is
            plain credential ownership with no association row.
        kind:
          type: string
          enum:
            - CONNECTED
            - GRANTED
          description: >-
            GRANTED = existing credential shared with the agent; CONNECTED =
            credential created for the agent (connect flow).
        credentials_id:
          type: string
          format: uuid
          nullable: true
          description: Linked credential row; null while OAuth connect is pending.
        integration: {}
        member_owned: {}
        owner: {}
        workspace: {}
        workspace_agent_id: {}
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
  securitySchemes:
    apiKey:
      type: http
      scheme: basic
      description: 'Account API key: key id as the username, secret as the password.'

````