---
title: "Create an API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Create an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://api.banksync.io`
- URL: `https://api.banksync.io/v1/api-keys`
- Auth: HTTP bearer

## Request body

- object
  - `name` string, required: Display name for this key
  - `scopes` string[], required: Scopes to grant (e.g. ["banks:read", "feeds:read"])
  - `expiresInDays` integer: Days until expiry; omit for no expiry
  - `cdrAcknowledged` boolean: Required for workspaces with CDR (Australian) banks: the customer acknowledges CDR data may be read into their own systems via this key.
  - `cdrWordingVersion` string: Disclosure wording version acknowledged (paired with cdrAcknowledged).

## Response `201`

API key created. The plaintext key is shown once — store it immediately.

- object
  - `success` true, required
  - `apiKey` string, required: Plaintext key — shown only once
  - `keyId` string, required
  - `expiresAt` string, nullable, required

## Other responses

- `400`: Invalid scopes
- `401`: Unauthorized
- `403`: Forbidden (Admin+ required)

---

[API](https://skmtc.dev/banksync/apis/banksync-api.md) · [All operations](https://skmtc.dev/banksync/apis/banksync-api/llms.txt) · [OpenAPI document](https://skmtc.dev/banksync/apis/banksync-api/revisions/94465f5ee922?raw)