---
title: "Make an API key"
method: POST
path: "/api/v1/api-keys"
tags: ["API keys"]
---

# Make an API key

`POST /api/v1/api-keys`

## Request

- Base URL: `http://localhost:5180`
- URL: `http://localhost:5180/api/v1/api-keys`
- Auth: API key in cookie `better-auth.session_token`

For a tool such as Zapier. Send it as `Authorization: Bearer <key>`. It opens this team only, with your access to it, and a `read` key cannot write. The key is in this answer and nowhere else: only its hash is kept.

## Request body

- object
  - `name` string, required
  - `access` 'read' | 'write'

## Response `200`

Made. Copy the key now.

- object
  - `ok` unknown, required
  - `data` object, required
    - `key` object, required
      - `id` string, required
      - `name` string, required: What the owner called it, and the name its changes are audited under.
      - `access` 'read' | 'write', required: `read` may only read. `write` may also file and change records.
      - `hint` string, required: The first characters of the key, so two keys can be told apart. The key itself is never shown again.
      - `createdAt` string, required: ISO 8601 timestamp.
      - `lastUsedAt` string, nullable, required: ISO 8601 timestamp.
    - `secret` string, required
  - `meta` object, required
    - `requestId` string, required: Echoed in the x-request-id header. Quote it in a bug report.

## Other responses

- `400`: No name, or a name too long.
- `403`: Asked with a key or a connected app.

---

[API](https://skmtc.dev/dardaris/apis/dardaris-api.md) · [All operations](https://skmtc.dev/dardaris/apis/dardaris-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dardaris/apis/dardaris-api/revisions/4aff33835c73?raw)