---
title: "Create a key"
method: POST
path: "/v1/keys"
tags: ["Account"]
---

# Create a key

`POST /v1/keys`

## Request

- Base URL: `https://api.locio.com.au`
- URL: `https://api.locio.com.au/v1/keys`
- Auth: API key in cookie `locio_session`

The response is the only time the key is shown: only a hash is stored, so it cannot be retrieved again.

A public key is safe in a browser and must name the sites it may be used from.

## Request body

- object
  - `name` string, required
  - `kind` 'secret' | 'public'
  - `allowed_origins` string[]

## Response `201`

Created. Copy the key now.

- object
  - `data` MintedKey
    - `id` integer
    - `name` string
    - `kind` 'secret' | 'public'
    - `hint` string: Enough to tell two keys apart, useless to a thief.
    - `allowed_origins` string[]
    - `last_used_at` string, date-time
    - `created_at` string, date-time
    - `key` string: Shown once. Not stored and not retrievable.
    - `note` string

## Other responses

- `400`: A public key was requested with no allowed origins, or an origin is not an origin.
- `401`: No key, or not a valid one. Revoked and unknown keys answer the same way.
- `402`: The quota for this billing period is spent. `X-Quota-Reset` says when it returns; the billing portal is how to raise it sooner.
- `403`: Signed in, but the email address is not confirmed.
- `429`: Too many requests a second for this plan. `RateLimit-Limit` says the rate and `Retry-After` says how long to wait; this is a rate, not a quota, so it clears in a second.

---

[API](https://skmtc.dev/locio/apis/locio-api.md) · [All operations](https://skmtc.dev/locio/apis/locio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/locio/apis/locio-api/revisions/c259c9f9b329?raw)