---
title: "Create Key"
method: POST
path: "/api/v1/auth/keys"
tags: ["grandline-auth"]
---

# Create Key

`POST /api/v1/auth/keys`

## Request

- Base URL: `https://grandline.luzomi.com`
- URL: `https://grandline.luzomi.com/api/v1/auth/keys`
- Auth: none declared

Mint a new API key for the calling user.

The cleartext key is returned ONCE in the response body. The server
stores only the argon2 hash + 8-char prefix; if the caller loses
the key they'll need to revoke it and create a new one.

API keys (and the MCP server) are a Standard/Premium feature — a Basic
account is web-UI-only, so key minting is refused for it.

## Request body

- ApiKeyCreateRequest
  - `name` string

## Response `201`

Successful Response

- ApiKeyCreateResponse: Returned exactly once when a key is minted. `key` is the cleartext that the caller must store — the server retains only the hash.
  - `id` integer, required
  - `name` string, required
  - `prefix` string, required
  - `key` string, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable

## Other responses

- `401`: Authentication required
- `404`: Key not found / not owned by caller
- `422`: Validation Error

---

[API](https://skmtc.dev/luzomi/apis/grandline-api.md) · [All operations](https://skmtc.dev/luzomi/apis/grandline-api/llms.txt) · [OpenAPI document](https://skmtc.dev/luzomi/apis/grandline-api/revisions/4ce06aea012b?raw)