---
title: "Mint an API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Mint an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://api.letmepost.dev`
- URL: `https://api.letmepost.dev/v1/api-keys`
- Auth: none required

Dashboard session only. The plaintext `key` is returned **once** in this response and never again — store it securely. Optional `profileId` pins the key to a single profile; cross-profile reads/writes 404 under that key.

## Headers

- `Idempotency-Key` string

## Request body

- CreateApiKeyRequest
  - `name` string, required
  - `prefix` 'lmp_live_' | 'lmp_test_'
  - `scopes` string[]
  - `profileId` string, uuid, nullable: Optional profile scope. When set, the key only authenticates requests targeting that profile; cross-profile reads/writes 404.

## Response `201`

Key minted — plaintext shown once.

- CreateApiKeyResponse
  - `id` string, required
  - `name` string, required
  - `prefix` string, required
  - `last4` string, required
  - `scopes` string[], required
  - `profileId` string, nullable
  - `key` string, required: Plaintext key — returned **once** at creation and never again. Store it securely.
  - `createdAt` string, date-time, required

## Other responses

- `400`: `validation_failed` — request body or query parameters didn't match the schema. Rules surfaced include `body.json`, `targets.required`, `targets.max`, `mode_conflict`, `targets.options.platform_mismatch`, `targets.account.platform_mismatch`, `target.account.not_connected`, `target.account.ambiguous`, `scheduledAt.future`, `scheduledAt.no_first_comment`, `scheduledAt.no_bluesky_reply`.
- `401`: `unauthenticated` — missing or invalid Bearer key.
- `404`: `not_found` — the resource does not exist in the caller's organization (or, for profile-scoped keys, in the caller's profile).
- `409`: `idempotency_conflict` — the same `Idempotency-Key` was used with a different request body. Use a new key, or retry with the original body.
- `429`: `rate_limited` — too many requests. Inspect `X-RateLimit-Limit` (static ceiling) and the IETF-draft `RateLimit-*` headers (sliding-window remaining/reset) before retrying.
- `500`: `internal_error` — something on our end failed unexpectedly. Quote the `requestId` when reporting.

---

[API](https://skmtc.dev/letmepost/apis/letmepost-dev-api.md) · [All operations](https://skmtc.dev/letmepost/apis/letmepost-dev-api/llms.txt) · [OpenAPI document](https://skmtc.dev/letmepost/apis/letmepost-dev-api/revisions/f6659001f96b?raw)