---
title: "Create an API key"
method: POST
path: "/apikey/"
tags: ["apikey"]
---

# Create an API key

`POST /apikey/`

## Request

- Base URL: `https://api.getoneprofile.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getoneprofile.ai/apikey/`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Create a new API key for the user. Requires a user authentication (not API key).

The response carries the key's value, and it is the only time it is ever shown: only a hash of it is stored. Keys that can write are part of every paid plan; a workspace on the free plan can create read-only keys.

## Request body

- APIKeyCreate
  - `expire_at` string, date-time, nullable: The date and time when the API key will expire. If not provided, the API key will never expire.
  - `name` string, required: The unique name of the API key.
  - `scope` 'read' | 'write': What a key may do. Two values, not a permission matrix. The thing worth stopping is a write nobody watched: a leaked read key exposes what the dashboard already shows the holder, a leaked write key spends credits and sends mail. A free workspace may only mint ``READ``.

## Response `201`

Successful Response

- APIKeyCreatedSchema: A key the moment it is made: the only response that carries the secret. Its own schema rather than a nullable field on ``APIKeyRead``, so no read route can grow a path that serves the value back by accident.
  - `created_at` string, date-time, required
  - `expire_at` string, date-time, nullable
  - `id` string, uuid, required
  - `key` string, required: The key's value. Shown here and nowhere else, ever: only a hash is stored. Copy it now; a lost key has to be replaced.
  - `key_prefix` string, required: The first characters of the key's value, so it can be told apart from another in a list. The value itself is shown once, when the key is created, and is not recoverable afterwards.
  - `last_used_at` string, date-time, nullable: When this key last authenticated a request, to the minute.
  - `name` string, required
  - `org_id` string, required
  - `scope` 'read' | 'write', required: What a key may do. Two values, not a permission matrix. The thing worth stopping is a write nobody watched: a leaked read key exposes what the dashboard already shows the holder, a leaked write key spends credits and sends mail. A free workspace may only mint ``READ``.
  - `updated_at` string, date-time, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `422`: An API key with the generated key already exists, or the workspace's plan does not allow the scope asked for.
- `500`: Internal server error.
- `502`: Bad gateway error.
- `503`: Service unavailable.

---

[API](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile.md) · [All operations](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile/llms.txt) · [OpenAPI document](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile/revisions/4a6bd71e3f02?raw)