> ## Documentation Index
> Fetch the complete documentation index at: https://docs.melso.ai/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Melso product MCP: https://melso.ai/api/mcp (OAuth; one company per grant). REST: https://melso.ai. Documentation-search MCP: https://docs.melso.ai/mcp. The docs search server does not act on customer accounts.
>
> Use the live tool schema and respect company membership. Ask the person to authorize the exact fiscal document version in the signed-in app. A professional prepares and files included returns after authorization; AI does not file alone. A prepared file or approval receipt is not evidence of filing. Never claim completion from an accepted Task or Run. Keep credentials out of chat and logs. Agents features are internal or by private invitation.
# Create workspace api key
> Company owner or admin using a browser session or personal access token in an Agents company. Other company types receive `403` with `code: agents_only`. Company API keys, Run tokens and MCP grants cannot create keys.
Request: `name:string` (1–120 characters), `expires_in_days?:integer` from 1 to 3650 (omit it for a key that never expires), `scope?:"tasks"|"admin"` (default `tasks`; see [Credential types](/api-reference/authentication#credential-types)). The scope never changes.
Response: `{key: WorkspaceAPIKeyResponse, token: string}`. `token` (`mwk_…`) is returned only here; Melso stores its hash.
Status: 201; 400 invalid name, expiry, scope or JSON; 429 when key creation is rate limited. Authentication and resource-access errors follow [Overview](/api-reference/errors).
## OpenAPI
````yaml /api-reference/openapi.json post /api/workspaces/{id}/api-keys
openapi: 3.1.0
info:
title: Melso API
version: '2026-10-12'
description: >-
Customer integration contracts for Melso. Agents access is internal or by
private invitation. Fiscal approval remains in the authenticated app.
contact:
name: Melso
url: https://melso.ai/en
servers:
- url: https://melso.ai
description: Production API origin
security: []
tags:
- name: Areas
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Areas operations available within the caller's documented permissions.
- name: Artifacts
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Artifacts operations available within the caller's documented permissions.
- name: Authentication
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Authentication operations available within the caller's documented
permissions.
- name: Automations
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Automations operations available within the caller's documented
permissions.
- name: Companies
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Companies operations available within the caller's documented permissions.
- name: Execution funding
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Execution funding operations available within the caller's documented
permissions.
- name: Files
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Files operations available within the caller's documented permissions.
- name: GitHub
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
GitHub operations available within the caller's documented permissions.
- name: Interactions
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Interactions operations available within the caller's documented
permissions.
- name: Knowledge
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Knowledge operations available within the caller's documented permissions.
- name: MCP
description: MCP operations available within the caller's documented permissions.
- name: Messages
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Messages operations available within the caller's documented permissions.
- name: OAuth
description: OAuth operations available within the caller's documented permissions.
- name: Private network
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Private network operations available within the caller's documented
permissions.
- name: Runs
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Runs operations available within the caller's documented permissions.
- name: Skills
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Skills operations available within the caller's documented permissions.
- name: Tasks
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Tasks operations available within the caller's documented permissions.
- name: Vault
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Vault operations available within the caller's documented permissions.
- name: Webhooks
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Webhooks operations available within the caller's documented permissions.
paths:
/api/workspaces/{id}/api-keys:
post:
tags:
- Authentication
summary: Create workspace api key
description: >-
Company owner or admin using a browser session or personal access token
in an Agents company. Other company types receive `403` with `code:
agents_only`. Company API keys, Run tokens and MCP grants cannot create
keys.
Request: `name:string` (1–120 characters), `expires_in_days?:integer`
from 1 to 3650 (omit it for a key that never expires),
`scope?:"tasks"|"admin"` (default `tasks`; see [Credential
types](/api-reference/authentication#credential-types)). The scope never
changes.
Response: `{key: WorkspaceAPIKeyResponse, token: string}`. `token`
(`mwk_…`) is returned only here; Melso stores its hash.
Status: 201; 400 invalid name, expiry, scope or JSON; 429 when key
creation is rate limited. Authentication and resource-access errors
follow [Overview](/api-reference/errors).
operationId: createWorkspaceAPIKey
parameters:
- name: id
in: path
required: true
description: id from the corresponding authorized response.
schema:
type: string
- name: X-Workspace-ID
in: header
required: false
description: >-
Company UUID for a personal token on company-scoped operations. A
company API key already binds its company.
schema:
type: string
format: uuid
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateWorkspaceAPIKeyRequestInput'
example:
name: Production
expires_in_days: 90
responses:
'201':
description: >-
`{key: WorkspaceAPIKeyResponse, token: string}`. `token` (`mwk_…`)
is returned only here; Melso stores its hash.
content:
application/json:
schema:
type: object
properties:
key:
$ref: '#/components/schemas/WorkspaceAPIKeyResponse'
token:
type: string
required:
- key
- token
'400':
description: Invalid request.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Authentication required.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Agents company required (agents_only), or credential/role denied.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Resource unavailable to this caller.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited; respect Retry-After when present.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'500':
description: Server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearerAuth: []
components:
schemas:
CreateWorkspaceAPIKeyRequestInput:
type: object
properties:
name:
type: string
expires_in_days:
anyOf:
- type: integer
- type: 'null'
scope:
anyOf:
- type: string
- type: 'null'
WorkspaceAPIKeyResponse:
type: object
properties:
id:
type: string
name:
type: string
token_prefix:
type: string
scope:
type: string
created_by:
type: string
created_at:
type: string
last_used_at:
anyOf:
- type: string
- type: 'null'
expires_at:
anyOf:
- type: string
- type: 'null'
required:
- id
- name
- token_prefix
- scope
- created_by
- created_at
- last_used_at
- expires_at
Error:
type: object
properties:
error:
type: string
code:
type: string
required:
- error
additionalProperties: true
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: >-
Company API key (mwk_) or personal access token (mel_). A PAT requires
X-Workspace-ID on company-scoped routes. An API key implies its own
company.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.