---
title: "Create Key"
method: POST
path: "/keys"
tags: ["Access"]
---

# Create Key

`POST /keys`

## Request

- Base URL: `https://api.hedra.com/v3`
- URL: `https://api.hedra.com/v3/keys`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

## Request body

- KeyCreateRequest
  - `name` string, nullable: Human-readable label for the key.
  - `scopes` ApiKeyScope[], nullable: Scopes granted to the key; omitted means the creating credential's own scopes, never the opt-in `sandboxes:read`, `sandboxes:write` and `sandboxes:exec`, which a key holds only by listing them, and only a workspace owner or admin can list.
  - `kind` 'personal' | 'service': Personal keys die with the member; service keys belong to the workspace.
  - `workspace_id` string, nullable: Target workspace; omitted means the authenticating key's workspace.
  - `expires_at` string, date-time, nullable: ISO-8601 instant the key stops authenticating; omitted means it never expires.

## Response `201`

Successful Response

- KeyCreateResponse
  - `key_id` string, required: The key's public identifier.
  - `credential` string, required: The full `<key_id>:<secret>` pair — a valid Bearer credential. Returned exactly once, at creation; store it now.
  - `kind` 'personal' | 'service', required: Personal keys die with the member; service keys belong to the workspace.
  - `name` string, nullable: Human-readable label for the key.
  - `scopes` string[], nullable: Scopes granted to the key; null means every scope except the opt-in `sandboxes:read`, `sandboxes:write` and `sandboxes:exec` (a legacy key predating scopes).
  - `workspace_id` string, nullable: The workspace the key bills and acts in.
  - `expires_at` string, date-time, nullable: ISO-8601 instant the key stops authenticating; null means it never expires.
  - `created_at` string, date-time, nullable: ISO-8601 instant the key was created.

## Other responses

- `400`: Invalid or failed-validation request.
- `401`: Authentication failed: missing, malformed, or invalid credentials.
- `403`: Insufficient scope or plan.
- `404`: Resource not found.
- `429`: Rate limit exceeded.
- `500`: Internal error.

## Changes

- **2026-10-23** `e733493214f4`: 3 info
  - added the new `sandboxes:exec` enum value to the request property `scopes/anyOf[subschema #1]/items/`
  - added the new `sandboxes:read` enum value to the request property `scopes/anyOf[subschema #1]/items/`
  - added the new `sandboxes:write` enum value to the request property `scopes/anyOf[subschema #1]/items/`
- **2026-10-16** `06692d16e78a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hedra-labs/apis/hedra-api/changes/keys/post.md)

---

[API](https://skmtc.dev/hedra-labs/apis/hedra-api.md) - [All operations](https://skmtc.dev/hedra-labs/apis/hedra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hedra-labs/apis/hedra-api/revisions/6ef35a11cefe?raw)