---
title: "Create project key"
method: POST
path: "/projects/{projectId}/keys"
---

# Create project key

`POST /projects/{projectId}/keys`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/projects/{projectId}/keys`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/api/v1/oauth/authorize`
    - Token URL: `/api/v1/oauth/token` scopes: `key:manage`
  - HTTP bearer
  - API key in cookie `cave_access`
  - API key in cookie `__Secure-cave_identity.session_token`

POST /api/v1/projects/{projectId}/keys on the Caveman Cloud control plane. Requires the key:manage scope. Not exposed to autonomous agents: Mints or approves a credential. An agent must never be able to widen its own access — this is the escalation boundary that makes scoped agent connections meaningful.

## Request body

- object
  - `name` string
  - `scopes` string[]
  - `member_user_id` string
  - `default_workflow` string
  - `allowed_models` string[]
  - `rpm_limit` integer
  - `tpm_limit` integer
  - `max_parallel` integer
  - `budget_usd` number
  - `budget_soft_usd` number
  - `budget_period` string
  - `tags` string[]
  - `metadata` object
  - `allowed_ips` string[]
  - `guardrails` string[], nullable
  - `expires_in` string
  - `expires_at` string

## Response `201`

Key with one-time full_key

## Other responses

- `2XX`: Successful response. Exact status depends on synchronous or durable delivery outcome.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)