---
title: "Create API key"
method: POST
path: "/api/v3/keys"
tags: ["API Keys"]
---

# Create API key

`POST /api/v3/keys`

Create a new API key for the authenticated user.

**The full key value is returned only once** in the creation response and cannot be retrieved again afterwards.

`expires_at` is required:
- A future datetime expires the key at that time.
- `null` creates a key that never expires.

**Workspace scoping (optional):** include `scopes` — a list of `{workspace_id, permission}` entries — to restrict the key to those workspaces. Each entry's `permission` is one of `viewer`, `editor`, or `owner`, and cannot exceed the role you currently hold on that workspace; a 400 is returned otherwise. Different scopes on the same key can carry different permissions.

## Request body

- CreateAPIKeyV3Request — Reject any request fields not declared on the serializer.
  - `name` string, required
  - `expires_at` string, date-time, nullable, required — Expiration datetime for the API key. Set to a future datetime to expire the key at that time, or null to create a key that never expires.
  - `scopes` APIKeyScopeRequest[] — Optional list of `{workspace_id, role}` entries. Providing this field marks the key as workspace-scoped: it can only access the listed workspaces, with the per-workspace role shown. The requested role on each workspace is capped at the role you currently hold there.
    - `workspace_id` integer, required
    - `role` 'viewer' | 'editor' | 'owner', required — * `viewer` - viewer * `editor` - editor * `owner` - owner

## Response `201`

API key created. The `key` field contains the full key value — save it now, it will not be shown again.

- CreateAPIKeyV3Response
  - `id` string, required
  - `name` string, required
  - `prefix` string, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable, required
  - `scopes` APIKeyScope[], required
    - `workspace_id` integer, required
    - `workspace_name` string, required
    - `workspace_upload_method` string, required
    - `workspace_datasource_type` string, nullable, required
    - `role` string, required
    - `scope_type` 'workspace' | 'global', required — * `workspace` - workspace * `global` - global
  - `key` string, required

## Other responses

- `400` — Bad Request — invalid fields, quota exceeded, or permission ceiling exceeded.
- `401` — Authentication credentials were not provided or are invalid

---

[API](https://skmtc.dev/lighton/apis/lighton-api.md) · [All operations](https://skmtc.dev/lighton/apis/lighton-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/lighton/lighton-api/revisions/86c57e94ef15/schema)