---
title: "Create an API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Create an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://api.naturali.ai`
- URL: `https://api.naturali.ai/v1/api-keys`
- Auth: HTTP bearer

Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.

## Request body

- ApiKeyCreate
  - `name` string, required: Key name for identification.
  - `project_id` string: Project to scope the key to. Omit for an account-scoped key.
  - `capabilities` string[]: Capabilities to grant. Omit to inherit the creator's capabilities.

## Response `201`

API key created. The raw key value is only returned here.

- ApiKeyCreated
  - `id` string, required: Public API key ID (key_ prefix).
  - `name` string, required
  - `key_prefix` string, required: Leading characters of the raw key, for identification.
  - `scope` 'project' | 'account', required: Whether the key is scoped to one project or the whole account.
  - `project_id` string, nullable: The project this key is scoped to; null for account-scoped keys.
  - `capabilities` string[], required: Capabilities granted to this key. Empty means it inherits the creator's.
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable: When the key was last presented; null if never used.
  - `key` string, required: The raw API key value (only returned once, at creation or rotation). Use as the Bearer token.

## Other responses

- `400`: The request was malformed or failed validation.
- `401`: Missing or invalid credentials.
- `403`: Authenticated, but not permitted to act on this key.

---

[API](https://skmtc.dev/naturali/apis/naturali-ai-api.md) · [All operations](https://skmtc.dev/naturali/apis/naturali-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/naturali/apis/naturali-ai-api/revisions/e4905b78f422?raw)