---
title: "Create an API key limited to projects"
method: POST
path: "/api_keys"
tags: ["API Keys"]
---

# Create an API key limited to projects

`POST /api_keys`

## Request

- Base URL: `https://api.llmpulse.ai/api/v1`
- URL: `https://api.llmpulse.ai/api/v1/api_keys`
- Auth: API key in header `Authorization`

Creates an API key limited to the projects in project_ids, owned by the same user as the calling key, and returns its secret token once: store it, since it cannot be read again. The key sees only those projects (any other project answers ERR_PROJECT_NOT_FOUND) and cannot act on the whole account, and the set of projects never changes. This endpoint never creates an account-wide key; create one in the app under API Keys. scope is read (default) or read_write. Every project must be one the caller can access: a project of another account, a deleted one or an unknown id answers ERR_PROJECT_NOT_FOUND and nothing is created. A user can hold up to 500 active keys; past that the request answers ERR_LIMIT_REACHED until a key is revoked. Requires an account-wide `read_write` scope API key on the Scale plan or above: a key limited to some projects answers ERR_KEY_PROJECT_SCOPED. A team member needs permission to create API keys and can only choose projects they can access.

## Request body

- object
  - `name` string, required: A label to recognize the key, for example the customer it is for
  - `scope` 'read' | 'read_write': read (default) only reads data; read_write can also create, change and delete within the key's projects
  - `project_ids` integer[], required: The projects the key is limited to, at least one

## Response `201`

Created. The key as GET /api_keys lists it, plus its secret token, returned only this once.

- object
  - `id` integer, required
  - `name` string, required
  - `prefix` string, required: The visible start of the token, to recognize the key. Never the secret itself.
  - `scope` 'read' | 'read_write', required
  - `project_scoped` boolean, required: True when the key is limited to project_ids; false for an account-wide key.
  - `project_ids` integer[], required: The projects the key is limited to; empty for an account-wide key.
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable, required: Updated at most once a minute.
  - `revoked_at` string, date-time, nullable, required
  - `token` string, required: The secret to send as Bearer token. Shown only in this response.
  - `request_id` string

## Other responses

- `401`: Authentication failed
- `403`: A key limited to some projects answers ERR_KEY_PROJECT_SCOPED and a read-only key ERR_INSUFFICIENT_SCOPE: managing keys needs an account-wide read and write key. A team member without the API Keys permission answers ERR_INSUFFICIENT_PERMISSION, and creating a key below the Scale plan ERR_PLAN_REQUIRED, with the same status
- `404`: Resource not found
- `422`: Invalid parameters

## Changes

- **2026-10-28** `06e08edc0987`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/llmpulse/apis/llm-pulse-api/changes/api_keys/post.md)

---

[API](https://skmtc.dev/llmpulse/apis/llm-pulse-api.md) - [All operations](https://skmtc.dev/llmpulse/apis/llm-pulse-api/llms.txt) - [OpenAPI document](https://skmtc.dev/llmpulse/apis/llm-pulse-api/revisions/38a31f123641?raw)