---
title: "Create an API key."
method: POST
path: "/api/v1/keys"
tags: ["keys"]
---

# Create an API key.

`POST /api/v1/keys`

## Request

- Base URL: `https://harvis.dev`
- URL: `https://harvis.dev/api/v1/keys`
- Auth: API key in cookie `better-auth.session_token`

The token comes back in this response and cannot be retrieved again — the row keeps only a digest of it. Session-only: a key cannot mint another key, or revoking one would mean nothing.

## Request body

- CreateApiKeyInput
  - `name` string, required: What the key is for, so you can recognise it later.

## Response `201`

Create an API key.

- CreateApiKeyResult
  - `key` ApiKey, required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: The first characters of the token, so a key can be recognised in a list.
    - `lastUsedAt` string, date-time, nullable, required: Written at most once an hour, so it lags by up to that.
    - `createdAt` string, date-time, required
  - `token` string, required: Shown exactly once. Send it as `Authorization: Bearer <token>`.

## Other responses

- `400`: `invalidRequest`, `nameRequired`
- `401`: `unauthorized`
- `403`: `crossOrigin`, `sessionRequired`

---

[API](https://skmtc.dev/harvis/apis/harvis-dev-api.md) · [All operations](https://skmtc.dev/harvis/apis/harvis-dev-api/llms.txt) · [OpenAPI document](https://skmtc.dev/harvis/apis/harvis-dev-api/revisions/b06f9e2deebb?raw)