---
title: "Create an API key [admin]"
method: POST
path: "/api_keys"
tags: ["api_keys"]
---

# Create an API key \[admin\]

`POST /api_keys`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/api_keys`
- Auth: HTTP bearer

Only the person's own sign-in or a personal key that is not fixed to one workspace may call this; a workspace key, an app acting for the person, a task pass, a key limited to one job and a key fixed to one workspace are refused with 403 `restricted_token`. A key never holds a scope the caller lacks (403 `insufficient_scope`). The secret is in this response; `reveal` reads it back later.

## Request body

- object
  - `name` string, required
  - `scopes` string[], required
  - `universe` string, nullable: Fix the key to this workspace, which the person must belong to.
  - `expires_at` string, date-time, nullable: When the key stops working; must be in the future. Omit for a key that does not expire.

## Response `201`

Created

- object
  - `api_key` ApiKey, required: One of the person's own API keys. Its secret is never part of it.
    - `id` string, required
    - `name` string, required
    - `token_prefix` string, required: The first characters of the secret, to tell keys apart.
    - `scopes` string[], required
    - `universe` string, nullable, required: The workspace the key is fixed to; null for a key that works in any of the person's workspaces.
    - `status` 'active' | 'revoked' | 'expired', required
    - `can_reveal` boolean, required: Whether `reveal` can read the secret back. Keys made before secrets were kept encrypted cannot.
    - `can_restore` boolean, required: Whether `restore` can make the key work again once revoked.
    - `current` boolean, required: True for the key this request was made with.
    - `last_used_at` string, date-time, nullable, required
    - `expires_at` string, date-time, nullable, required
    - `revoked_at` string, date-time, nullable, required
    - `created_at` string, date-time, required
  - `secret` string, required: The key itself. Keep it like a password.

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/api_keys/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/8280a065ef6a?raw)