--- title: "Create API key" method: POST path: "/settings/2/api-keys" tags: ["platform", "account-management", "api-keys"] --- # Create API key `POST /settings/2/api-keys` ## Request - Base URL: `https://api.infobip.com` (the document declares no server; this is the origin it was published from) - URL: `https://api.infobip.com/settings/2/api-keys` - Auth: one of: - OAuth 2 - Client credentials - Token URL: `https://api.infobip.com/auth/1/oauth2/token` - API key in header `Authorization` - HTTP basic This method allows you to create an API key. Only users with certain roles can create api keys; for example, Account Manager and Integrations Manager roles. ## Request body - Bb8af9c2d2d4d677e25555100e31662e23d86ede8b5d73bbf4974b4decdd08d7CreateApiKeyRequest - `accountId` string: Unique identifier for account this API key will belong to. If not provided accountId of the user making the API request will be set. CPaaSX Applications and Entities can be set only on api keys that belong to the account of the user making the request and only if that account is main account. - `name` string, required: Name of this API Key. - `allowedIPs` string[]: List of IP addresses or IP ranges from which this API key will be used. Authentication will fail from any other IP not specified in this list. - `validFrom` string, date-time: Date from which this API key will be valid. Time is in UTC. Should not be earlier than creation date. If not provided default is date of creation. - `validTo` string, date-time: Date until this API key will be valid. Time is in UTC. Should not be earlier than validFrom or creation time. If not provided default is 1 year from creation. - `permissions` string[]: List of permissions this API key has granted. Default permission is 'PUBLIC_API'. API key cannot be created with both 'PUBLIC_API' and 'WEB_SDK' permissions. API key cannot be created with both permissions and a collection of Applications and/or Entities in platform. - `platform` Bb8af9c2d2d4d677e25555100e31662e23d86ede8b5d73bbf4974b4decdd08d7Platform[]: A collection of CPaaS X Applications and Entities that will be linked to the API Key. API key cannot be created with both permissions and a collection of Applications and/or Entities. - `key` string: Unique identifier of application and/or entity association. - `applicationId` string, required: ID of a CPaaS X Application. Once linked to an Application, the API key can only be used to send messages using linked Applications. Mandatory for every Application and/or Entity pair. Use the default value to reference a default Application. Use an existing Application created using [create-application endpoint](https://www.infobip.com/docs/api/platform/application-entity/create-application) or specify a new applicationId to create a new Application. - `entityId` string: ID of a CPaaS X Entity. Once linked to an Entity, the API key can only be used to send messages using linked Entities. Use an existing Entity created using [create-entity endpoint](https://www.infobip.com/docs/api/platform/application-entity/create-entity) or specify a new entityId to create a new Entity. - `action` 'FILL' | 'FORCE': An optional action performed for an API request authenticated by this specific API key. The `FILL` option is used when an API endpoint inserts linked Application and Entity IDs into a request, if missing. The `FORCE` option is used when an API endpoint overrides linked Application and Entity IDs with the ones from this platform. If the action is left blank, the API endpoint will only perform an authorization check without injecting values into the request. - `scopeGuids` string[]: List of [API scopes](https://www.infobip.com/docs/essentials/api-essentials/api-authorization#available-api-scopes-api-scopes) that will be assigned to the API key. ## Response `200` OK - Bb8af9c2d2d4d677e25555100e31662e23d86ede8b5d73bbf4974b4decdd08d7ApiKey - `id` string: Unique identifier specifying this api key. - `apiKeySecret` string: Authentication key. Use this value for authentication on API. Keep this in secure storage and don't share it. - `accountId` string: Unique identifier for account this API key belongs to. - `name` string, required: Name of this API Key. - `allowedIPs` string[]: List of allowed IP addresses from which this API key will be used. Authentication will fail from any other IP not specified in this list. - `validFrom` string, date-time: Date from which this API key is/will be valid. Time is in UTC. - `validTo` string, date-time: Date until this API key will be valid. Time is in UTC. - `enabled` boolean: Is API key enabled. - `permissions` string[]: List of permissions this API key has granted. - `platform` Bb8af9c2d2d4d677e25555100e31662e23d86ede8b5d73bbf4974b4decdd08d7Platform[]: A collection of CPaaS X Applications and/or Entities associated with the API Key - `key` string: Unique identifier of application and/or entity association. - `applicationId` string, required: ID of a CPaaS X Application. Once linked to an Application, the API key can only be used to send messages using linked Applications. Mandatory for every Application and/or Entity pair. Use the default value to reference a default Application. Use an existing Application created using [create-application endpoint](https://www.infobip.com/docs/api/platform/application-entity/create-application) or specify a new applicationId to create a new Application. - `entityId` string: ID of a CPaaS X Entity. Once linked to an Entity, the API key can only be used to send messages using linked Entities. Use an existing Entity created using [create-entity endpoint](https://www.infobip.com/docs/api/platform/application-entity/create-entity) or specify a new entityId to create a new Entity. - `action` 'FILL' | 'FORCE': An optional action performed for an API request authenticated by this specific API key. The `FILL` option is used when an API endpoint inserts linked Application and Entity IDs into a request, if missing. The `FORCE` option is used when an API endpoint overrides linked Application and Entity IDs with the ones from this platform. If the action is left blank, the API endpoint will only perform an authorization check without injecting values into the request. - `scopeGuids` string[]: List of Scopes assigned to API Key ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden - `429`: Too Many Requests - `500`: Internal Server Error --- [API](https://skmtc.dev/infobip/apis/infobip-openapi-specification.md) - [All operations](https://skmtc.dev/infobip/apis/infobip-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/infobip/apis/infobip-openapi-specification/revisions/9dcbbaf902de?raw)