---
title: "Create an API key for a workspace"
method: POST
path: "/workspaces/{id}/api-keys"
tags: ["Workspace"]
---

# Create an API key for a workspace

`POST /workspaces/{id}/api-keys`

## Request

- Base URL: `https://api.emailchaser.com/r`
- URL: `https://api.emailchaser.com/r/workspaces/{id}/api-keys`
- Auth: HTTP bearer

Mints an API key bound to a workspace the calling key already owns: its own workspace, or one of its sub-workspaces when called with a main workspace's key. The key returned by POST /r/workspaces is shown once and cannot be retrieved again, so this is how a workspace whose key was lost gets a new one without a UI step. The new key authorizes the named workspace only and never outlives the caller: when the calling key has an expiry, the minted key carries the same expiresAt. fullKey is returned exactly once.

## Path parameters

- `id` integer, required

## Request body

- ModelsCreateWorkspaceApiKeyRequest
  - `name` string: Name shown in the app's API key list. Defaults to "<workspace name> key". Trimmed; up to 60 characters.
  - `readOnly` boolean: ReadOnly mints a key that can call GET routes and four POSTs that buy and send nothing (/r/audience/size, /r/setup/ping, /r/dfy/domains/check and /r/lead-finder/searches), and nothing else. Defaults to false, which mints a read+write key.

## Response `201`

The workspace and its new API key

- ModelsCreateWorkspaceApiKeyResponse
  - `apiKey` ModelsCreatedApiKey
    - `expiresAt` string: ExpiresAt is set when the key expires: it inherits the calling key's own expiry, so a temporary key never mints a permanent one. Null for keys minted by a non-expiring key.
    - `fullKey` string
    - `id` integer
    - `name` string
    - `scopes` string[]
  - `note` string: Note reminds integrators that fullKey is not retrievable later.
  - `workspace` ModelsWorkspaceItem
    - `createdAt` string
    - `iconUrl` string: IconURL is where the workspace's icon image can be loaded from. Empty when the workspace has none. Icons are uploaded in the app.
    - `id` integer
    - `isCurrent` boolean: IsCurrent is true for the workspace the calling API key is bound to.
    - `name` string

## Other responses

- `400`: Invalid workspace ID or request body
- `401`: Unauthorized - invalid or missing API key
- `403`: The workspace's plan does not include the API, or the subscription is not active
- `404`: No such workspace under this account
- `500`: Failed to create API key

---

[API](https://skmtc.dev/emailchaser/apis/emailchaser-api.md) · [All operations](https://skmtc.dev/emailchaser/apis/emailchaser-api/llms.txt) · [OpenAPI document](https://skmtc.dev/emailchaser/apis/emailchaser-api/revisions/8b114990abb7?raw)