---
title: "POST /v1/orgs/:slug/api-keys — generate a new API key (Member+)."
method: POST
path: "/v1/orgs/{slug}/api-keys"
tags: ["api-keys"]
---

# POST /v1/orgs/:slug/api-keys — generate a new API key (Member+).

`POST /v1/orgs/{slug}/api-keys`

The raw key is returned **once** in the response. Only its SHA-256 credential
fingerprint is used for authentication. The key is owned by the creating user.

## Path parameters

- `slug` string, required

## Request body

- CreateApiKeyRequest — POST /v1/orgs/:slug/api-keys
  - `name` string, required

## Response `200`

API key created (raw key returned once)

- CreateApiKeyResponse — Returned to the caller once on creation — includes the full plaintext key.
  - `created_at` string, date-time, required
  - `id` string, uuid, required
  - `key` string, required
  - `name` string, required

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — Insufficient permissions
- `409` — Name already exists

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)