Create an MCP staff key (value shown once)
Platform admins may create a workspace-scoped key (no wildcard; grant workspaces afterwards).
Global access ("every workspace") is expressed ONLY through wildcardRole; it and any write grant
require a saas_admin_users role 'owner' (403 OWNER_ROLE_REQUIRED). default_role is always stored
as 'none'; a legacy defaultRole of 'read'/'write' is applied as wildcardRole (the stronger wins).
Every key expires: expiresAt defaults to now + 90 days and may be at most 365 days away.
The admin log records only server-built values; any client reason/newValues/oldValues
is kept as operator_note.
POST
https://api.channelautomation.com/api/admin/mcp-permissions/keysAuthorization
Request body JSON required
Returns
200
{ success, data: { apiKey (plaintext, shown once), key: { ..., expires_at } } }