---
title: "Create API key (self, step-up)"
method: POST
path: "/api/v1/account/api-keys"
tags: ["account"]
---

# Create API key (self, step-up)

`POST /api/v1/account/api-keys`

## Request

- Base URL: `https://amplerun-api.spiry.org`
- URL: `https://amplerun-api.spiry.org/api/v1/account/api-keys`
- Auth: HTTP bearer

Label, expiry and explicit renter/host scopes. Secret revealed once; only hash stored. No admin scopes or key-based MFA bypass.

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- object
  - `label` string, required
  - `expires_at` string, date-time
  - `scopes` string[], required

## Response `201`

API key created; secret returned exactly once.

- object: API key metadata. The secret itself appears only in the creation response.
  - `key_id` string, uuid, required
  - `label` string, required
  - `prefix` string, required: First 12 characters of the key, for recognising it.
  - `scopes` string[], required
  - `expires_at` string, date-time, required
  - `revoked_at` string, date-time, required
  - `created_at` string, date-time, required
  - `secret` string, required: The API key. Store it now; it is not shown again.

## Other responses

- `default`: Error envelope. 401 unauthenticated, 403/404 forbidden, 409 conflict, 422 invalid input, 429 rate limited (code UNAVAILABLE, retryable:true, no Retry-After header), 503 unavailable money/provider state with retryable:true.

---

[API](https://skmtc.dev/amplerun/apis/amplerun-business-api.md) · [All operations](https://skmtc.dev/amplerun/apis/amplerun-business-api/llms.txt) · [OpenAPI document](https://skmtc.dev/amplerun/apis/amplerun-business-api/revisions/40944687fa52?raw)