---
title: "Create an API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Create an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://hcti.io`
- URL: `https://hcti.io/v1/api-keys`
- Auth: HTTP basic

Creates a key with explicit permissions no broader than the calling key's current grants. Save api_key securely: only this response includes the secret.

**Rate limit:** 20 requests per minute per organization, shared across all operations in the `api-key:write` group and all API keys belonging to that organization.

## Request body

- CreateOrUpdateApiKeyRequest: Configuration for creating or updating an API key. Updates replace the configuration; omitted optional settings are cleared or reset to their defaults.
  - `name` string, nullable: Display name for the key, up to 255 characters. Omitted, null, or blank names use Key created YYYY-MM-DD HH:mm:ss, based on the key's original creation time in UTC.
  - `description` string, nullable: Optional description of the key's purpose, up to 2000 characters. Omitted, null, or blank clears the description.
  - `disabled` boolean: Whether the key is disabled. Disabled keys cannot authenticate requests. Defaults to false.
  - `all_future_permissions` boolean: Grant all current and future permissions. Only callers with this authority can enable it. Defaults to false.
  - `permissions` string[], required: Complete list of current permissions to grant, for example images:create or templates:read. Ignored when all_future_permissions is true; supply an empty array in that case. Otherwise, an empty array grants no product permissions. Permissions cannot exceed the caller's authority.

## Response `200`

OK

- ApiKeyWithSecret: A newly created API key, including its secret. The secret is returned only when creating a key; store it securely.
  - `api_key` string, required: Secret API key used as the password when authenticating API requests. Store it securely; subsequent API responses do not include it.
  - `id` string, required: ID used to retrieve, update, or delete this API key.
  - `api_id` string, required: API ID used as the username when authenticating API requests.
  - `name` string, required: Display name for the key.
  - `description` string, nullable: Description of the key's purpose, if provided.
  - `enabled` boolean: Whether the key is enabled.
  - `all_future_permissions` boolean: Whether the key automatically receives all current and future permissions.
  - `permissions` string[], required
  - `created_at` string, date-time: When the key was created, in UTC.
  - `updated_at` string, date-time: When the key was last updated, in UTC.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests

## Changes

- **2026-10-30** `146fbf859b2d`: 3 warning, 3 info
  - added the new `webhooks:create_update` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:delete` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:read` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `webhooks:create_update` enum value to the request property `permissions/items/`
  - …2 more
- **2026-10-14** `b686893a3e5f`: 2 warning, 2 info
  - added the new `debugs:create` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `debugs:read` enum value to the `permissions/items/` response property for the response status `200`
  - added the new `debugs:create` enum value to the request property `permissions/items/`
  - added the new `debugs:read` enum value to the request property `permissions/items/`
- **2026-09-14** `d5730c2a58f6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/changes/v1/api-keys/post.md)

---

[API](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api.md) - [All operations](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/llms.txt) - [OpenAPI document](https://skmtc.dev/htmlcsstoimage/apis/html-css-to-image-api/revisions/100550373ae1?raw)