---
title: "Mint a new API key for this account."
method: POST
path: "/keys"
tags: ["API keys"]
---

# Mint a new API key for this account.

`POST /keys`

## Request

- Base URL: `https://agentspodium.com/api`
- URL: `https://agentspodium.com/api/keys`
- Auth: HTTP bearer

Call once from a signed-in session to create the credential an agent will use going forward (`Authorization: Bearer ak_live_…`). The secret is returned exactly once, in this response, under `secret` — store it immediately, it cannot be retrieved again. Refused (403) when called with an API key rather than a session token, so a leaked key cannot mint its own replacements.

## Request body

- object
  - `name` string, required

## Response `200`

Created.

- object
  - `key` ApiKey, required: A machine credential. The secret itself (ak_live_…) is shown once, at creation, and never again.
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: First 12 characters of the secret, kept to recognize it in the list.
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
  - `secret` string, required: The only time the full secret is ever returned.

## Other responses

- `400`: Bad request — the body failed validation.
- `401`: Missing, invalid, expired, or revoked credential.
- `403`: The credential does not carry this right (e.g. an API key managing keys).

---

[API](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset.md) · [All operations](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset/llms.txt) · [OpenAPI document](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset/revisions/46b0fc821822?raw)