---
title: "Create an API key"
method: POST
path: "/o/{org}/api-keys"
tags: ["API keys"]
---

# Create an API key

`POST /o/{org}/api-keys`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/api-keys`
- Auth: HTTP bearer

Mints a key that acts as the caller (an org admin) on the session
routes. The `secret` is in this response only; it is never stored or
shown again. Without `expires_at` the key never expires.

## Request body

- object
  - `name` string, required
  - `scopes` ApiKeyScope[]: Defaults to both scopes.
  - `max_concurrent` integer: Runs this key may have in progress at once.
  - `expires_at` string, date-time, nullable: In the future and at most one year away.

## Response `201`

The key, with its secret.

- ApiKeyWithSecret: An `ApiKey` with its `secret`, as create and rotate return it. The secret is never shown again.
  - `id` string, required: `key_…`; use it in the key routes.
  - `kind` 'key' | 'oauth': `key` is minted here; `oauth` is an MCP client a person connected by signing in. An `oauth` grant reaches only the MCP server, cannot be rotated and has no webhook; its `expires_at` is when it ends unless the client refreshes it.
  - `name` string, required
  - `prefix` string, required: The secret's first characters, to tell keys apart.
  - `scopes` ApiKeyScope[], required
  - `max_concurrent` integer, required
  - `webhook_url` string, nullable, required
  - `expires_at` string, date-time, nullable, required
  - `created_by` object, required
    - `id` string, required
    - `email` string, nullable, required
  - `last_used_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `stats` object: The runs the key started in the last seven days. Only in the list. `finished` counts runs that ended `completed` or `needs_review`, out of `ended`. `webhook_deliveries` is the state of each run's latest completion webhook: delivered, still being retried, or dropped after the last try.
    - `since` string, date-time, required
    - `runs` integer, required
    - `finished` integer, required
    - `ended` integer, required
    - `spend_usd` number, required
    - `mcp_runs` integer, required: Of `runs`, those started through MCP.
    - `webhook_deliveries` object, required
      - `delivered` integer, required
      - `retrying` integer, required
      - `failed` integer, required
  - `secret` string, required: The key's secret. Only in the create and rotate responses; never shown again.
  - `webhook_secret` string: The webhook signing secret. Only in the update response that minted it.

## Other responses

- `400`: An invalid field (`VALIDATION_ERROR`).
- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.
- `404`: No such resource for the caller, including one in an org the caller is not in or a Project that is private to someone else.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/e351f947926b?raw)