---
title: "Create an API key (admin, interactive session only)"
method: POST
path: "/api-keys"
tags: ["API keys"]
---

# Create an API key (admin, interactive session only)

`POST /api-keys`

## Request

- Base URL: `https://api.app.lastaccountingcompany.com/portal`
- URL: `https://api.app.lastaccountingcompany.com/portal/api-keys`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lastaccountingcompany/apis/lac-customer-api/docs/api-keys/post.ts> (a function with typed inputs; its response is checked against the schema)

Mints a new portal API key with scope `read` or `write`. The `api_key` secret (`lac_sk_...`) is returned once and never again — store it securely. Requires an interactive admin session; API-key bearers receive 403.

## Request body

- object
  - `name` string, required: Human-readable key name (max 120 characters).
  - `scope` 'read' | 'write', required: `read` keys are refused on all mutating methods; `write` keys act as the operator role.

## Response `201`

Key created. The secret is returned only in this response.

- object
  - `api_key` string: The bearer secret, `lac_sk_...`. Shown only once.
  - `record` ApiKey: Portal API key metadata (never contains the secret).
    - `id` string
    - `name` string
    - `scope` 'read' | 'write'
    - `created_by` string
    - `created_at` string
    - `last_used_at` string, nullable
    - `revoked_at` string, nullable

## Other responses

- `401`: Missing or invalid bearer token.
- `403`: Insufficient scope or role — e.g. a read-scoped key on a mutating method, or an API key on an admin/approver-only endpoint.

---

[API](https://skmtc.dev/lastaccountingcompany/apis/lac-customer-api.md) - [All operations](https://skmtc.dev/lastaccountingcompany/apis/lac-customer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lastaccountingcompany/apis/lac-customer-api/revisions/52e277b4f031?raw)