---
title: "Create API key"
method: POST
path: "/apiKeys"
tags: ["Settings"]
---

# Create API key

`POST /apiKeys`

Use the *Create API keys* endpoint to generate a new API key for your client.

[API keys](https://docs.codat.io/platform-api#/schemas/apiKeys) are tokens used to control access to the API. Include this token in the `Authorization` header parameter when making API calls, following the word "Basic" and a space with your API key.

You can [read more](https://docs.codat.io/using-the-api/authentication) about authentication at Codat and managing API keys via the Portal UI or API.

### Tips and pitfalls

* Your first API key is created for you. Access this key via [Codat's Portal](https://app.codat.io/developers/api-keys).
* If you require multiple API keys, perform multiple calls to the *Create API keys* endpoint. 
* The number of API keys is limited to 10. If you have reached the maximum amount of keys, use the *Delete API key* endpoint to delete an unused key first.

## Request body

- CreateApiKey — Details about the newly created API key.
  - `name` Name — unresolved $ref

## Response `201`

Success

- ApiKeyDetails, nullable — Datetime in UTC the API key was created. The created date will be null if the API key created before YYYY-MM-DD.
  - `id` string — Unique identifier for the API key.
  - `name` string, nullable — A meaningful name assigned to the API key.
  - `apiKey` string — The API key value used to make authenticated http requests.
  - `createdDate` string — In Codat's data model, dates and times are represented using the <a class="external" href="https://en.wikipedia.org/wiki/ISO_8601" target="_blank">ISO 8601 standard</a>. Date and time fields are formatted as strings; for example: ``` 2020-10-08T22:40:50Z 2021-01-01T00:00:00 ``` When syncing data that contains `DateTime` fields from Codat, make sure you support the following cases when reading time information: - Coordinated Universal Time (UTC): `2021-11-15T06:00:00Z` - Unqualified local time: `2021-11-15T01:00:00` - UTC time offsets: `2021-11-15T01:00:00-05:00` > Time zones > > Not all dates from Codat will contain information about time zones. > Where it is not available from the underlying platform, Codat will return these as times local to the business whose data has been synced.

## Other responses

- `400` — Bad Request
- `401` — Your API request was not properly authorized.
- `402` — An account limit has been exceeded. The type of limit is described in the error property: - You have exceeded the 50-company limit that applies to a Free plan. Delete any companies you no longer need and retry the request. - The requested sync schedule is not allowed. You requested an hourly sync schedule but this functionality is not included in the Free plan. - Your Free account is older than 365 days and has expired. Contact support@codat.io.
- `403` — You are using an outdated API key or a key not associated with that resource.
- `409` — Conflict
- `429` — Too many requests were made in a given amount of time. Wait a short period and then try again.
- `500` — There is a problem with our server. Please try again later.
- `503` — The Codat API is temporarily offline for maintenance. Please try again later.

---

[API](https://skmtc.dev/codatio/apis/platform-api.md) · [All operations](https://skmtc.dev/codatio/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/codatio/platform-api/revisions/bff9b9776ecf/schema)