Update from code changes: document API key IP allowlists

[mintlify]

Summary

Documents new per-key controls for the Mintlify REST API: an optional IP/CIDR allowlist for admin and assistant API keys, optional read/write scopes for admin API keys, and an optional expiration date for both key types. All three are set at key creation on the dashboard API keys page, are fixed for the lifetime of the key, and leave existing keys unrestricted when omitted. Requests that don't satisfy a key's allowlist or scope are rejected with a 403, and requests using an expired key are rejected.

Changes

• api/introduction.mdx: New "Restrict keys by IP address" subsection covering scope, entry formats (IPv4, IPv6, CIDR), disallowed catch-alls, and when to use it. New "Restrict admin keys by scope" subsection covering the read/write values, the method-to-scope mapping (GET/HEAD → read, others → write), the write satisfies read rule, and the 400 on invalid values. New "Set an expiration date" subsection covering the ISO 8601 requirement, the 400 on past or invalid timestamps, and the expiresAt field returned when listing keys.
• es/api/introduction.mdx, fr/api/introduction.mdx, zh/api/introduction.mdx: Mirror all three subsections in Spanish, French, and Chinese with localized headings and anchor IDs restrict-keys-by-ip-address, restrict-admin-keys-by-scope, and set-an-expiration-date.

Update history

• Documented per-key IP/CIDR allowlists for admin and assistant API keys in api/introduction.mdx and mirrored the section to es/ and zh/. Triggered by https://github.com/mintlify/server/pull/6469.
• Added the French translation (fr/api/introduction.mdx) and wrapped the new heading in <div id="restrict-keys-by-ip-address"> across es/fr/zh so anchor links resolve on translated pages.
• Documented optional read/write scopes for admin API keys — including the HTTP-method-to-scope mapping and the write-satisfies-read rule — in api/introduction.mdx and mirrored the section into es/, fr/, and zh/. Triggered by https://github.com/mintlify/server/pull/6476.
• Documented the optional expiration date for admin and assistant API keys — including the ISO 8601 requirement, the 400 on past/invalid timestamps, and the expiresAt field returned when listing keys — in api/introduction.mdx and mirrored the section into es/, fr/, and zh/. Triggered by https://github.com/mintlify/server/pull/6481.

---

Note

Low Risk
Documentation-only changes to MDX intro pages with no runtime or API behavior changes in this repo.

Overview
The REST API Authentication section in api/introduction.mdx now documents three optional per-key controls configured at creation on the dashboard API keys page: IP/CIDR allowlists (admin and assistant keys; mismatches return 403), admin-only read/write scopes mapped from HTTP method (GET/HEAD → read, others → write, with write implying read), and expiration via a future ISO 8601 timestamp (expiresAt when listing keys).

Each control is immutable for the life of the key (rotate by delete-and-recreate), and keys without these settings behave as before. The same content is mirrored in es/, fr/, and zh/ api/introduction.mdx, with localized headings and stable anchor IDs on the translated pages for deep linking.

^{Reviewed by Cursor Bugbot for commit 45cfefc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
mintlify	🟢 Ready	View Preview	Jul 7, 2026, 10:41 PM

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
tomee	🟢 Ready	View Preview	Jul 7, 2026, 10:41 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Update from code changes updated this PR.

Added read/write scope restrictions for admin API keys

Source PRs

• mintlify/server#6476 — [ENG-9995] Add read/write scopes to external API keys

[mintlify]

Update from code changes updated this PR.

Added optional expiration date for admin and assistant API keys

Source PRs

• mintlify/server#6481 — feat: add expires at for api key creation

[mintlify]

Update from code changes updated this PR.

Added nothing; dashboard UI change required no new documentation

Source PRs

• mintlify/mint#8943 — Add IP allowlist and scopes to API key creation