---
title: "Create an API key"
method: POST
path: "/users/api-keys"
tags: ["API Keys"]
---

# Create an API key

`POST /users/api-keys`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/users/api-keys`
- Auth: HTTP bearer

Company-admin only. The plaintext token is returned once.

## Request body

- object
  - `name` string, required
  - `scope` 'read' | 'write'
  - `expiresInDays` 30 | 90 | 365, nullable: Null or omitted = never expires.

## Response `201`

- ApiKeyCreated: Never carries the plaintext token (see ApiKeyCreated).
  - `id` string, uuid, required
  - `name` string, required
  - `keyPrefix` string, required
  - `active` boolean, required
  - `scope` 'read' | 'write', required: `read`: GET only. `write`: everything except the operations marked `x-atako-api-key: forbidden`.
  - `expiresAt` string, date-time, nullable, required: Past this instant the key is refused (401 API_KEY_EXPIRED). Null = never.
  - `lastUsedAt` string, date-time, nullable
  - `createdAt` string, date-time, required

## Other responses

- `400`: name required / invalid scope / invalid expiresInDays
- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: The caller does not have the required role/permission.

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)