---
title: "Create an API Key and reveal its secret once"
method: POST
path: "/api-keys"
tags: ["API Keys"]
---

# Create an API Key and reveal its secret once

`POST /api-keys`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/api-keys`
- Auth: API key in cookie `__Host-fd_session` and API key in header `X-CSRF-Token`

## Headers

- `Idempotency-Key` string, required

## Request body

- CreateApiKeyRequest
  - `name` string, required
  - `scopes` string[], required
  - `expiresAt` string, date-time

## Response `201`

Created; the same idempotent replay may return the same encrypted response for five minutes

- ApiKeyCreated
  - `apiKey` ApiKey, required: Public API Key metadata. Internal primary/retiring rotation state is intentionally omitted; a retiring key remains `active` until scheduledRevocationAt.
    - `id` string, required
    - `name` string, required
    - `prefix` string, required
    - `last4` string, required
    - `scopes` string[], required
    - `status` 'active' | 'revoked' | 'expired', required
    - `lastUsedAt` string, date-time, nullable
    - `expiresAt` string, date-time, nullable
    - `scheduledRevocationAt` string, date-time, nullable: Planned revocation time for an overlapping retiring key; null for a primary or immediately revoked key.
    - `createdAt` string, date-time, required
  - `secret` string, required: Plaintext secret returned only by this create/rotate transaction. Newly issued secrets use the `fd_` prefix. Previously issued `fd_test_` and `fd_live_` secrets still authenticate. An authenticated replay with the same Idempotency-Key and request body may receive the same KMS-encrypted response for five minutes; it is not recoverable afterward.

## Other responses

- `401`: Authentication required or invalid
- `403`: Authenticated but not permitted, or CSRF validation failed
- `409`: Resource state or idempotency conflict
- `422`: Request validation failed
- `503`: A required dependency or catalog is temporarily unavailable

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)