---
title: "Create Api Key"
method: POST
path: "/v1/keys"
tags: ["keys"]
---

# Create Api Key

`POST /v1/keys`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/v1/keys`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Provision a new API key (authenticated callers only — task #39).

The anonymous self-service flow was removed by the Portal Epic — keys
are now minted through ``POST /v1/me/keys`` after signing up at
``/app/signup`` and verifying the account email. This endpoint stays
online for already-authenticated programmatic callers so existing
integrations that mint sibling keys keep working until they migrate.

The plaintext key is returned in ``key`` **exactly once** — it is not
stored and cannot be retrieved again.

## Request body

- ApiKeyCreate
  - `label` string, nullable
  - `user_email` string, nullable

## Response `201`

Successful Response

- ApiKeyResponse
  - `id` string, uuid, required
  - `key` string, required
  - `label` string, nullable
  - `tier` string, required
  - `commercial_use_allowed` boolean
  - `created_at` string, date-time, nullable
  - `example_call` string, nullable: Copy-paste curl against a known-indexed domain (GH #706). Host is taken from EXAMPLE_CALL_DOMAIN (allow-listed); substitute $CERTINDEX_API_KEY.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)