Document scoped API keys

[sjmiller609]

Documents scoped API keys on the API Keys page: creating a key with a policy of allow statements, and setting an exact expires_at.

Changes

• API Keys (info/api-keys.mdx): new Scope a key to specific resources section. It explains statements, actions, and resources briefly, then gives TypeScript and Python examples and the expiry, revocation, and rotation rules. The list, rotate, and troubleshooting sections now cover policy.
• API Key Permissions (info/api-key-permissions.mdx, new): reference page with resource formats, every action by resource kind, operations that need more than one action, and what scoped keys can't do. Added to the Manage navigation after API Keys.

Before merging

Merge once scoped key issuance ships in the API and the SDKs expose policy and expires_at on apiKeys.create. The examples use those SDK fields. Go examples are left out until the generated Go types exist.

Checked locally with mintlify dev: the page renders and the new anchors resolve.

---

Note

Low Risk
Documentation-only changes with no runtime or security logic modifications.

Overview
Adds documentation for scoped API keys: creating keys with a policy of allow statements and optional exact expires_at, plus a dedicated permissions reference.

API Keys (info/api-keys.mdx) gains a Scope a key to specific resources section (policy model, TypeScript/Python create examples, expiry/revocation caveats including that CDP URLs survive key deletion). List/retrieve, rotate, and troubleshooting now mention policy, insufficient_scope, and scoped-key validation errors.

API Key Permissions (info/api-key-permissions.mdx) is new: resource patterns, actions per resource kind, multi-action operations, and endpoints scoped keys cannot use. It’s linked from the API Keys page and added to the Manage nav in docs.json.

^{Reviewed by Cursor Bugbot for commit 9b2cf5f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 14, 2026, 6:09 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[Sayan-]

• p1: info/api-key-permissions.mdx:63-64 says projects:read and organizations:read allow metadata and limit reads. These action names are accepted in policies, but all corresponding endpoints reject scoped keys with 403 insufficient_scope, even with the documented grants.
• p2: info/api-keys.mdx:162 limits its expiry/revocation warning to already-open browser connections. Previously obtained CDP and WebDriver URLs can also establish new connections after the API key expires or is deleted, while the browser remains active. Those URLs authenticate independently of the API key.

[sjmiller609]

Thanks, both addressed in 9b2cf5f:

• p1: removed projects:read and organizations:read from the reference page and listed project and organization endpoints under Not available to scoped keys.
• p2: the expiry and revocation note now says previously obtained CDP, WebDriver, and live view URLs keep working, including for new connections, until the browser is deleted.

[Sayan-]

yeet awesome stuff!