---
title: "Create an API key"
method: POST
path: "/keys"
tags: ["keys"]
---

# Create an API key

`POST /keys`

## Request

- Base URL: `https://api.gogoscreen.com/api/v1`
- URL: `https://api.gogoscreen.com/api/v1/keys`
- Auth: HTTP bearer

Mint a key for this account. The plaintext is in the response and nowhere else: it is never stored in readable form and cannot be recovered. A key may hold any scope except `keys:manage`: a credential that could create credentials would outlive its own revocation. At most 25 active keys per account.

## Headers

- `Idempotency-Key` string, required

## Request body

- object
  - `expiresAt` string, date-time, nullable: When the key stops working. Omit for a key that does not expire.
  - `name` string, required: What this key is for. Shown in the console and in the account's audit trail.
  - `rateLimitPerDay` integer, nullable: A daily request cap for this key alone (up to 864000, the per-minute ceiling run for 24 hours).
  - `rateLimitPerMinute` integer, nullable: A ceiling below the rate class's own. Cannot raise it.
  - `scopes` string[], required: What the key may do. At least one, and from this list only: two scopes are never on it. `keys:manage` is withheld because a key that could mint keys would outlive its own revocation, and `assistant:use` because the in-app assistant is for people in the dashboard, not for integrations.

## Response `200`

Create an API key

- object
  - `apiKey` object, required
    - `createdAt` string, date-time, required
    - `expiresAt` string, date-time, nullable, required
    - `id` string, required
    - `last4` string, required: The last four characters, for telling two keys apart in a list.
    - `lastUsedAt` string, date-time, nullable, required: Written at most once a minute, so it is accurate to the minute and not to the request.
    - `name` string, required
    - `prefix` string, required: `gsk_live_` plus the first eight characters of the secret. Enough to recognise a key; not enough to use one.
    - `rateLimitPerDay` number, nullable, required: A per-key daily cap. Null means uncapped by the key itself.
    - `rateLimitPerMinute` number, nullable, required: A per-key ceiling. Null means the rate class's own limit applies; a number can only ever lower it.
    - `revokedAt` string, date-time, nullable, required
    - `scopes` string[], required
    - `status` 'active' | 'revoked' | 'expired', required
  - `key` string, required: THE KEY. This is the only time it is shown: it is never stored in readable form and cannot be recovered. Save it now; if it is lost, rotate.

## Other responses

- `400`: `validation_failed` — That request is not valid. · `idempotency_key_required` — This operation needs an Idempotency-Key header: a string of up to 128 characters, unique to this request, so a retry cannot do the work twice.
- `401`: `unauthorized` — Authentication is required.
- `403`: `forbidden_scope` — This credential does not carry the scope this operation needs. · `email_unverified` — Confirm your email address to use this operation.
- `404`: `not_found` — No such resource.
- `409`: `idempotency_conflict` — That idempotency key was already used with a different request. · `idempotency_in_progress` — That idempotency key is still being processed. · `conflict` — That request conflicts with the current state.
- `413`: `payload_too_large` — That request body is too large.
- `415`: `unsupported_media_type` — That content type is not supported.
- `429`: `rate_limited` — Too many requests. Try again shortly.
- `500`: `internal_error` — Something went wrong. Try again.

---

[API](https://skmtc.dev/gogoscreen/apis/gogoscreen-api.md) · [All operations](https://skmtc.dev/gogoscreen/apis/gogoscreen-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gogoscreen/apis/gogoscreen-api/revisions/2fd812319d75?raw)