---
title: "Create an API key"
method: POST
path: "/apikey/create"
tags: ["API Keys"]
---

# Create an API key

`POST /apikey/create`

## Request

- Base URL: `https://apisign.io/api`
- URL: `https://apisign.io/api/apikey/create`
- Auth: API key in header `x-api-key`

Create an API key. The raw key is returned only in this response.

## Request body

- object
  - `name` string, required
  - `permission` 'read' | 'read_write': Applies to the MCP server only; REST endpoints do not check it
  - `expiresInDays` number: Days until the key expires. Omit for no expiry.

## Response `200`

Key created

- object
  - `apiKey` object
    - `id` string
    - `name` string
    - `start` string: First 8 characters of the key
    - `permission` 'read' | 'read_write': Applies to the MCP server only; REST endpoints do not check it
    - `enabled` boolean
    - `expiresAt` string, date-time, nullable
    - `createdAt` string, date-time
    - `key` string: The raw API key (starts with `ask_`). Shown only once.
  - `message` string

## Other responses

- `400`: Invalid request, or the action is not allowed in the resource's current state
- `401`: Missing, invalid, expired or deleted API key. Body: `{ "error": "Unauthorized" }`
- `500`: Internal server error (also returned for a request body that is not valid JSON)

---

[API](https://skmtc.dev/apisign/apis/api-sign-api.md) · [All operations](https://skmtc.dev/apisign/apis/api-sign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apisign/apis/api-sign-api/revisions/fa21d8adbc69?raw)