---
title: "Create an API key"
method: POST
path: "/teams/{id}/keys"
tags: ["API Keys"]
---

# Create an API key

`POST /teams/{id}/keys`

## Request

- Base URL: `https://api.indexone.io`
- URL: `https://api.indexone.io/teams/{id}/keys`
- Auth: API key in header `x-api-key` and API key in header `Authorization`

Creates an API Gateway key for the team and attaches it to the usage plan that carries the rate limit. The plaintext key is in the `value` field of the response — but it is also retrievable later via `GET /teams/{id}/keys`, so it is not a show-once secret.

The caller must be a member of the team. **A non-member gets HTTP 200** with `{"message": "Not authorized to perform this operation"}`, not a 403.

## Path parameters

- `id` string, required

## Response `200`

The new key — or, if the caller is not a team member, `{"message": "Not authorized to perform this operation"}` with this same 200 status.

- ApiKey: An API Gateway key belonging to a team.
  - `id` string: API Gateway key id — the value passed to `DELETE /teams/{id}/keys/{key_id}`.
  - `value` string: The key itself, in plaintext. Send it as the `x-api-key` header.
  - `created_at` string, date: `YYYY-MM-DD`.
  - `enabled` boolean

## Other responses

- `401`: Missing or invalid id token.
- `403`: Missing or invalid `x-api-key`.
- `429`: API key usage-plan rate limit exceeded.

---

[API](https://skmtc.dev/indexone/apis/index-one-rest-api.md) · [All operations](https://skmtc.dev/indexone/apis/index-one-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indexone/apis/index-one-rest-api/revisions/df5a92216a9c?raw)