b2_create_key
Create a B2 application key with defined capabilities, bucket scope, and expiration. The secret is written to an out-of-band sink or returned inline with a warning.
Instructions
Create a B2 application key. In file sink mode, the one-time key secret is written to the configured out-of-band secret sink and the MCP response contains only redacted metadata plus a secretSink pointer. In inline mode, the secret is returned with an explicit warning.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm this durable credential creation. Required when the server destructive policy is 'confirm' (the default). | |
| keyName | Yes | Human-readable name for the new key. | |
| bucketId | No | Deprecated single-bucket restriction. Use bucketIds for new integrations; do not provide both. | |
| bucketIds | No | Optional bucket restrictions. Omit for account-wide access. | |
| namePrefix | No | Optional file-name prefix restriction for file capabilities. | |
| capabilities | Yes | B2 capabilities to grant to the new key. | |
| idempotencyKey | Yes | Caller-generated idempotency key. Reuse the same value only when retrying the identical durable-key creation request. | |
| validDurationInSeconds | No | Optional key lifetime in seconds. Omit for no expiration. |