---
title: "Create a scoped publisher automation token."
method: POST
path: "/api/publisher/api-keys"
tags: ["Publisher"]
---

# Create a scoped publisher automation token.

`POST /api/publisher/api-keys`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/publisher/api-keys`
- Auth: HTTP bearer

Returns plaintext token once and stores only a SHA-256 hash. Publisher tokens can only create keys inside their allowed namespaces.

**Inputs.** No path or query fields are required. The request body schema lists accepted fields and required values.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.

**Example setup.** Set HUGGING_BAY_TOKEN to a credential with the role or scope stated by this operation. Reader tokens do not grant publisher or operator rights. This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.

## Request body

- object
  - `allowedOwners` string[]
  - `owner` string
  - `displayName` string
  - `purpose` string

## Response `201`

Publisher API key created

- PublisherApiKeyIssue
  - `schemaVersion` 'hugging-bay.publisher-api-key-issue.v1', required
  - `generatedAt` string, required
  - `principal` object, required
  - `apiKey` object, required
    - `id` string, required
    - `principalId` string, required
    - `role` 'publisher', required
    - `displayName` string
    - `allowedOwners` string[], required
    - `status` string, required
    - `tokenPrefix` string, required
    - `createdAt` string, required
    - `purpose` string
    - `token` string, required: One-time plaintext publisher token. Stored server-side only as a hash.
    - `warning` string
  - `next` object, required
  - `policy` string[]

## Other responses

- `403`: Publisher or admin token required
- `422`: Invalid or unauthorized owner scope

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/63c474bf0fe4?raw)