---
title: "Issue an API key"
method: POST
path: "/v1/keys"
tags: ["Keys"]
---

# Issue an API key

`POST /v1/keys`

## Request

- Base URL: `https://brain.inite.ai`
- URL: `https://brain.inite.ai/v1/keys`
- Auth: HTTP bearer

Mints a key brain verifies itself, returning the plaintext ONCE — it is stored only as a SHA-256 hash and cannot be recovered. The granted scopes are the requested ones intersected with what the calling credential already holds, so a key is never wider than its issuer; asking for none that the caller holds is 403. Only the four delegable scopes are accepted (`brain:read`, `brain:write`, `brain:admin`, `brain:read_pii`) — operator scopes are not mintable. A user-bound caller can only bind the key to itself. Tenants are capped at 25 live keys.

Required scope: `brain:read`.

## Request body

- IssueKeyRequest
  - `expiresInDays` integer
  - `name` string, required
  - `scopes` string[], required
  - `userId` string

## Response `201`

The key, shown once.

- IssuedKeyResponse
  - `companyId` string, required
  - `key` string, required
  - `keyRecord` ApiKeySummary, required
    - `createdAt` string
    - `createdBy` string
    - `expiresAt` string
    - `id` string, required
    - `lastUsedAt` string
    - `name` string, required
    - `prefix` string, required
    - `revokedAt` string
    - `scopes` string[], required
    - `userId` string
  - `mcpUrl` string, required

## Other responses

- `400`: Validation failed.
- `401`: Missing or unknown bearer key.
- `403`: The key lacks the required scope.

---

[API](https://skmtc.dev/inite/apis/inite-brain-platform-api.md) · [All operations](https://skmtc.dev/inite/apis/inite-brain-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inite/apis/inite-brain-platform-api/revisions/c7c3eb5e304b?raw)