---
title: "Create a tunnel key"
method: POST
path: "/tunnelkeys/"
tags: ["SIMs (Devices)"]
---

# Create a tunnel key

`POST /tunnelkeys/`

## Request

- Base URL: `https://dashboard.hologram.io/api/1`
- URL: `https://dashboard.hologram.io/api/1/tunnelkeys/`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/hologram/apis/hologram-rest-api-v1/docs/tunnelkeys/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a new tunnel key. If `public_key` is omitted, the server generates a 2048-bit RSA keypair and returns the private key in the response — save it immediately, it is not stored. The key type must be `ssh-rsa`. At most 5 enabled keys are allowed per user. If the org does not have a plan that supports device tunneling, this endpoint returns 403.

## Request body

- object
  - `public_key` string: OpenSSH-format RSA public key; if omitted the server generates a keypair

## Response `200`

OK

- TunnelKeyResponse
  - `success` boolean: Indicates whether the request was successful.
  - `data` TunnelKeyObject
    - `id` integer
    - `userid` integer
    - `public_key` string: OpenSSH-format RSA public key
    - `disabled` 0 | 1: 1 if the key is disabled
    - `created_at` string, date-time
    - `private_key` string, nullable: RSA private key; only present when the server generates the keypair (no public_key supplied on create)

## Other responses

- `400`: Invalid public key format or tunnel key limit reached
- `401`: Unauthorized
- `403`: Organization does not have tunnel access

---

[API](https://skmtc.dev/hologram/apis/hologram-rest-api-v1.md) - [All operations](https://skmtc.dev/hologram/apis/hologram-rest-api-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/hologram/apis/hologram-rest-api-v1/revisions/1bc07dcd1631?raw)