---
title: "Mint an API key (session-only; plaintext returned once)"
method: POST
path: "/v1/keys"
---

# Mint an API key (session-only; plaintext returned once)

`POST /v1/keys`

## Request

- Base URL: `https://api.grundfast.dk`
- URL: `https://api.grundfast.dk/v1/keys`
- Auth: API key in cookie `gf_session`

Body: { name, mode: live|test, kind: secret|public, allowedOrigins?, permission?, expiresAt? }. kind=public mints a publishable gf_pub_ key (read_only, needs ≥ 1 allowed origin; see the publicKey security scheme). When the email-verification flow is enabled, minting a live key requires a verified email (403 otherwise). Test keys are never gated. `scopes` (secret keys only) narrows the key to named areas (adresse, bbr, matrikel, dagi, dhm, stednavne, cvr, energimaerke, vurdering, plan, miljoe, luftfoto, eksport, overvaagning) and/or grants the account scopes `usage` and `webhooks`, which no key holds unless it names them. Omitted = every data area. Out-of-scope calls answer 403 `key_scope`.

## Request body

- CreateApiKeyInput
  - `name` string, required
  - `permission` 'full_access' | 'read_only' | 'admin'
  - `mode` 'live' | 'test'
  - `kind` 'secret' | 'public'
  - `allowedOrigins` string[]
  - `expiresAt` string, date-time
  - `scopes` string[]

## Response `201`

Created

## Other responses

- `401`: Error
- `403`: Error

---

[API](https://skmtc.dev/grundfast/apis/grundfast-api.md) · [All operations](https://skmtc.dev/grundfast/apis/grundfast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/grundfast/apis/grundfast-api/revisions/ccef6e299bb5?raw)