---
title: "Create an API key"
method: POST
path: "/organizations/current/api-keys"
tags: ["Organizations"]
---

# Create an API key

`POST /organizations/current/api-keys`

## Request

- Base URL: `https://api.hookdeck.com/2025-07-01`
- URL: `https://api.hookdeck.com/2025-07-01/organizations/current/api-keys`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Create an organization or project API key. Creating organization API keys requires an admin session. Organization API keys can only create project keys, and only with scopes they hold on that project.

## Request body

- object
  - `label` string, required
  - `type` 'organization' | 'project', required
  - `team_id` string
  - `scopes` string[]: Permission scopes; defaults to ["*"] (full access) when omitted. For organization keys limited to specific projects, these scopes apply within each granted project. When the caller is an API key, every scope (including per-resource grant scopes) must be one the caller itself holds on the target project.
  - `grants` object: Organization keys: the projects the key is limited to, keyed by project ID with `true` (or `{}`) values — scopes stay in the root `scopes` property. Project keys: per-resource scope overrides keyed by resource ID.

## Response `200`

The created API key

- ApiKey
  - `id` string, required: The API key ID
  - `label` string, required: The API key label
  - `key` string: The API key secret used as the bearer token
  - `team_id` string, nullable: The project the key is scoped to, or null for organization keys
  - `organization_id` string: The organization the key belongs to
  - `key_fingerprint` string, nullable: Non-secret fingerprint identifying the key
  - `scopes` string[]: Base permission scopes; ["*"] is full access
  - `grants` object: Per-subject scope overrides: keyed by project ID for organization keys, resource ID for project keys
  - `expires_at` string, nullable: When the key expires, or null while active
  - `updated_at` string: Last update timestamp
  - `created_at` string: Creation timestamp

## Other responses

- `400`: Bad Request

## Changes

- **2026-09-24** `9bebff6c68f9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hookdeck/apis/hookdeck-admin-rest-api/changes/organizations/current/api-keys/post.md)

---

[API](https://skmtc.dev/hookdeck/apis/hookdeck-admin-rest-api.md) - [All operations](https://skmtc.dev/hookdeck/apis/hookdeck-admin-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hookdeck/apis/hookdeck-admin-rest-api/revisions/b1b6f4bac5a1?raw)