---
title: "Issue a key. Default scope read-only + 1yr expiry; pass scopes:[\"write\"] for full. Raw key returned once."
method: POST
path: "/api-keys"
tags: ["Auth & Key Management"]
---

# Issue a key. Default scope read-only + 1yr expiry; pass scopes:\["write"\] for full. Raw key returned once.

`POST /api-keys`

## Request

- Base URL: `https://api-dev.fusehealth.com`
- URL: `https://api-dev.fusehealth.com/api-keys`
- Auth: HTTP bearer

Issue a key. Default scope read-only + 1yr expiry; pass scopes:["write"] for full. Raw key returned once.

## Request body

- object
  - `name` string
  - `kind` 'secret' | 'publishable': "secret" (default) — server-side management key, governed by scopes. "publishable" — fuse_pk_… key for the browser; may call ONLY POST /api/v1/checkout/sessions (everything else answers 403 KEY_KIND_NOT_ALLOWED). scopes are ignored for a publishable key and forced to read+write so that one route passes requireWrite.
  - `scopes` string[]
  - `expiresAt` string, date-time: Omit for the 1-year default; null opts out of expiry; a past date is 400.

## Response `201`

Success — data.apiKey is the raw key, returned exactly once; data.kind echoes the key type.

- object
  - `success` boolean
  - `message` string
  - `data` unknown

## Other responses

- `401`: Missing, invalid, inactive, or expired API key (or JWT)
- `403`: Authenticated but not permitted (insufficient scope, wrong role, or FUSE feature not enabled)

---

[API](https://skmtc.dev/fusehealth/apis/fuse-brand-api-external.md) · [All operations](https://skmtc.dev/fusehealth/apis/fuse-brand-api-external/llms.txt) · [OpenAPI document](https://skmtc.dev/fusehealth/apis/fuse-brand-api-external/revisions/50821832728c?raw)