---
title: "Create Api Key"
method: POST
path: "/api-keys"
tags: ["API Keys"]
---

# Create Api Key

`POST /api-keys`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/api-keys`
- Auth: HTTP bearer

Mint a new API key for the caller's own org. The token is returned exactly once.

## Headers

- `X-Target-Org-Id` string, nullable
- `Authorization` string, nullable

## Request body

- ApiKeyCreateRequest: Request to mint a new organization API key. ``extra="forbid"`` so a caller sending ``org_id``, ``is_agency`` or ``is_ops`` gets an explicit 422 instead of the field being silently dropped — it is a stronger, more debuggable signal that those fields do not exist on this door.
  - `name` string, required: Human-readable name for the key
  - `expires_in_days` integer, nullable: Days until key expires (optional)
  - `mode` 'live' | 'test' | 'sandbox': Key mode. A 'test' key is returned with a g8_test_ prefix; a 'live' key carries g8_live_; a 'sandbox' key carries g8_sbx_ and only authenticates against the graph8 developer sandbox. A key minted by a 'test'-mode credential is always forced to 'test' regardless of this field — a test key may not mint itself a live successor.
  - `scopes` string[], nullable: Restrict the new key to specific resource:action scopes (e.g. ['contacts:read', 'deals:*']). '*' grants everything; 'resource:*' grants every action on a resource. Omitted or empty grants the full current scope vocabulary (today's status quo for an unscoped key), stored explicitly so the key stays narrowable and auditable rather than permanently unrestricted.
  - `ip_allowlist` string[]: Optional list of IPv4/IPv6 CIDR strings (e.g. ['10.0.0.0/8', '2001:db8::/32']). Bare IPs are accepted as /32 (IPv4) or /128 (IPv6). When non-empty, only requests from a matching IP are accepted — all others receive 403. Empty list (the default) means unrestricted: the key works from any IP address. Maximum 50 entries.

## Response `201`

Successful Response

- ApiResponseApiKeyCreateResponse
  - `data` ApiKeyCreateResponse, required: Response after minting a key. ``api_key_token`` is returned exactly once, here, at creation. No other endpoint on this router — or the app's — ever returns it again.
    - `api_key_id` string, required
    - `api_key_token` string, required
    - `name` string, required
    - `mode` string
    - `scopes` string[]
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)