Keys

Creates a new API key with the specified alias.

Keys are created with granular permissions. Pass preset for a named preset or permissions to list them explicitly; omit both to get the API preset.

Important Security Notice: The key_secret is only returned once at creation time. Store it securely immediately as it cannot be retrieved again. If lost, you must delete the key and create a new one.

Key Features:

  • Create API keys programmatically without UI access
  • Assign meaningful aliases for key identification
  • Scope a key with a named preset or an explicit list of permissions
  • Optionally set an expiry with expires_at
  • Keys are immediately active upon creation

Common Use Cases:

  • Programmatic key provisioning for CI/CD pipelines
  • Self-serve key generation for team members
  • Automated key rotation workflows
  • Integration with secret management systems

Required permissions: auth:keys:write. Key presets that include them: FULL. See key permissions.

post/keys

Request

  • Base URL
    https://api.fal.ai/v1
  • URL
    https://api.fal.ai/v1/keys
  • Auth
    API key in header Authorization

Request body

aliasstring required

Required friendly name for the API key

descriptionstring

Optional description of what the key is for

preset'FULL' | 'AGENT' | 'API' | 'DEPLOY' | 'READONLY' | 'BILLING' | 'COMPUTE' | 'SERVERLESS'

Named permission preset to apply. Defaults to "API" when neither preset nor permissions is given. Mutually exclusive with permissions.

permissionsstring[]

Explicit list of permissions to grant instead of a preset. Mutually exclusive with preset.

expires_atstring date-time

ISO8601 timestamp after which the key stops working

Example request

{
  "alias": "Production Key",
  "description": "CI deploy key for the main environment",
  "preset": "API",
  "permissions": [
    "models:requests:read",
    "models:requests:write"
  ],
  "expires_at": "2025-07-15T12:00:00Z"
}

Response

API key created successfully. Store the key_secret securely - it will not be shown again.

key_idstring required

Unique identifier for the newly created API key

key_secretstring required

Secret portion of the API key. IMPORTANT: This is only returned once at creation time and cannot be retrieved again.

keystring required

Full API key in the format 'key_id:key_secret'. Use this value directly for API authorization. IMPORTANT: This is only returned once at creation time and cannot be retrieved again.

Example response

{
  "key_id": "abc123def456",
  "key_secret": "sk_live_abc123...",
  "key": "abc123def456:sk_live_abc123..."
}

Changes

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      the endpoint scheme security fullApiKey was added to the API

    • info

      the endpoint scheme security adminApiKey was removed from the API