diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index af43dc96..b55f19e9 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.124.0"
+  ".": "0.125.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6259fd8a..82ce40f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.125.0](https://github.com/kernel/kernel-node-sdk/compare/v0.124.0...v0.125.0) (2026-10-13)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([635766d](https://github.com/kernel/kernel-node-sdk/commit/635766db0f0e9d2dada9f134403533b97c41e7b2))
+
 ## [0.124.0](https://github.com/kernel/kernel-node-sdk/compare/v0.123.0...v0.124.0) (2026-10-13)
 
 
diff --git a/package.json b/package.json
index 30855bd6..56a628ce 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.124.0",
+  "version": "0.125.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts
index 7901f3cc..42ae0958 100644
--- a/src/resources/api-keys.ts
+++ b/src/resources/api-keys.ts
@@ -12,7 +12,8 @@ import { path } from '../internal/utils/path';
  */
 export class APIKeys extends APIResource {
   /**
-   * Create a new API key within the authenticated organization.
+   * Create a new API key. API keys may be scoped by project and may include a
+   * policy.
    *
    * @example
    * ```ts
@@ -156,6 +157,12 @@ export interface APIKey {
    * project name is unavailable.
    */
   project_name: string | null;
+
+  /**
+   * Permissions granted to a scoped API key. Absent for an ordinary key, which keeps
+   * unrestricted access within its organization or project.
+   */
+  policy?: APIKey.Policy | null;
 }
 
 export namespace APIKey {
@@ -175,6 +182,32 @@ export namespace APIKey {
      */
     name: string | null;
   }
+
+  /**
+   * Permissions granted to a scoped API key. Absent for an ordinary key, which keeps
+   * unrestricted access within its organization or project.
+   */
+  export interface Policy {
+    /**
+     * Allow statements. Every action and resource not listed is denied.
+     */
+    statements: Array<Policy.Statement>;
+  }
+
+  export namespace Policy {
+    export interface Statement {
+      /**
+       * Permitted action, such as browsers:use or vaults:read.
+       */
+      action: string;
+
+      /**
+       * Resource the action applies to, in the format projects/{project_id}/{kind}/{id}.
+       * Wildcards are supported.
+       */
+      resource: string;
+    }
+  }
 }
 
 /**
@@ -194,16 +227,57 @@ export interface APIKeyCreateParams {
   name: string;
 
   /**
-   * Number of days until expiry, up to 3650. Use null for never.
+   * Number of days until expiry, up to 3650. Use null for never. Cannot be combined
+   * with expires_at.
    */
   days_to_expire?: number | null;
 
+  /**
+   * Exact expiry time. Must be in the future and no later than the issuing
+   * credential's own expiry. Cannot be combined with days_to_expire.
+   */
+  expires_at?: string | null;
+
+  /**
+   * Issue a scoped key that may only perform the listed actions on the listed
+   * resources.
+   */
+  policy?: APIKeyCreateParams.Policy;
+
   /**
    * Unique project identifier
    */
   project_id?: string | null;
 }
 
+export namespace APIKeyCreateParams {
+  /**
+   * Issue a scoped key that may only perform the listed actions on the listed
+   * resources.
+   */
+  export interface Policy {
+    /**
+     * Allow statements. Every action and resource not listed is denied.
+     */
+    statements: Array<Policy.Statement>;
+  }
+
+  export namespace Policy {
+    export interface Statement {
+      /**
+       * Permitted action, such as browsers:use or vaults:read.
+       */
+      action: string;
+
+      /**
+       * Resource the action applies to, in the format projects/{project_id}/{kind}/{id}.
+       * Wildcards are supported.
+       */
+      resource: string;
+    }
+  }
+}
+
 export interface APIKeyRetrieveParams {
   /**
    * When true, return the API key even if it has been deleted (soft-deleted), for
diff --git a/src/version.ts b/src/version.ts
index f8a5815b..671589e3 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.124.0'; // x-release-please-version
+export const VERSION = '0.125.0'; // x-release-please-version
diff --git a/tests/api-resources/api-keys.test.ts b/tests/api-resources/api-keys.test.ts
index 6456eace..087efe81 100644
--- a/tests/api-resources/api-keys.test.ts
+++ b/tests/api-resources/api-keys.test.ts
@@ -25,6 +25,10 @@ describe('resource apiKeys', () => {
     const response = await client.apiKeys.create({
       name: 'staging',
       days_to_expire: 30,
+      expires_at: '2025-01-15T09:00:00Z',
+      policy: {
+        statements: [{ action: 'browsers:use', resource: 'projects/proj_abc123/browsers/br_abc123' }],
+      },
       project_id: 'proj_abc123',
     });
   });