Account

Create an API key

Create an API key in your account; its plaintext secret is returned exactly once.

  • Without scoped_company_ids it reaches the creator’s tax IDs, never more; a scope above the plan returns 422.
  • environment: test mints a sandbox fact_test_ key; otherwise fact_live_.
  • An uncovered scope returns 403 insufficient_scope; * excludes accounts:* and admin scopes.
post/accounts/{account}/api-keys

Request

  • Base URL: https://api.factuarea.com/v1
  • URL: https://api.factuarea.com/v1/accounts/{account}/api-keys
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

accountstring uuid required

Public identifier (UUID v7) of your account. Get it from GET /v1/me (data.account.id).

Headers

Idempotency-Keystring
Example:01928f10-7c0e-7c4a-9b7d-2f8a6e3c1d4b

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 422 idempotency_key_reused; the values of secret fields (password, secret…) count as part of the body, so retrying with a corrected secret under the same key is a different request, never the replay of the earlier answer. See the Idempotency guide.

Factuarea-Versionstring date
Example:2026-06-01

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Request body

namestring required

Human-readable name for the API key (1-120 characters).

scopesstring[] required

List of scopes from the closed v1 catalog (at least one).

expires_atstring date-time nullable

Future ISO 8601 date after which the key stops authenticating.

ip_allowliststring[] nullable

Optional list of allowed IPs / CIDR ranges (IPv4, IPv6, /N).

environment'live' | 'test' | 'null' nullable

Key environment: live (production) or test (sandbox). Defaults to live.

scoped_company_idsstring[] nullable

Optional public identifiers (UUID v7) of the companies of your account the key will reach; when omitted, the same companies as the credential that creates it. Not accepted with environment: test.

Response

API key created. The Location header contains the canonical URL of the new key.

Example response

{
  "data": {
    "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b0c",
    "object": "api_key",
    "name": "Producción",
    "prefix": "fact_live_1OSf9KdP",
    "scopes": [
      "account:read",
      "invoices:read",
      "invoices:write"
    ],
    "tier": "scale",
    "environment": "live",
    "created_at": "2026-01-15T09:30:00Z",
    "last_used_at": "2026-05-25T18:00:00Z",
    "is_active": true,
    "ip_allowlist": [
      "203.0.113.10",
      "198.51.100.0/24"
    ],
    "last_used_ip": "203.0.113.10",
    "nif_scope": [
      {
        "id": "01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01",
        "tax_id": "B12345674",
        "name": "Acme Soluciones SL",
        "access_level": "operate"
      }
    ],
    "created_by": {
      "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b11",
      "name": "Marta Ibáñez"
    },
    "revoked_by": {
      "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b11",
      "name": "Marta Ibáñez"
    },
    "secret_rotated_by": {
      "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b11",
      "name": "Marta Ibáñez"
    },
    "secret": "fact_live_1OSf9KdPq8r2s4t6u8w0y2A4c6E8g0I2"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.