---
title: "Issue an independently scoped API key"
method: POST
path: "/credits/tenants/me/keys"
tags: ["Tenants"]
---

# Issue an independently scoped API key

`POST /credits/tenants/me/keys`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/tenants/me/keys`
- Auth: HTTP bearer

Creates an overlapping named credential. Requires a workspace owner or admin with credentials:manage and MFA or passkey step-up completed in the last ten minutes. A human caller cannot put a scope on a secret key that is absent from their own effective membership scopes. tools.enable narrows the tenant-enabled catalog for this key; pricing applies only to end-user calls and never widens tenant enablement. kind 'sandbox' issues a scopeless test credential (lcrsb_...) whose metered calls are simulated: no credits move and no providers are called. Unknown body fields are rejected with 400.

## Headers

- `X-Locus-Step-Up` string, password

## Request body

- ApiKeyCreateRequest
  - `kind` 'secret' | 'publishable' | 'sandbox', required
  - `name` string
  - `scopes` CreditsTenantScope[]
  - `tools` object
    - `enable` string[], required
  - `pricing` CredentialPricingPolicy
    - `markupBps` integer
    - `flatMarkupUsdc` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `endpoints` object
  - `expiresIn` integer

## Response `201`

{ success, kind, key, keyMetadata } — the raw key is returned exactly once, with the stored lifecycle metadata beside it.

## Other responses

- `400`: Invalid kind, name, scopes (including a secret scope the acting member does not hold), tools, pricing, expiresIn — or an unknown body field.
- `403`: STEP_UP_REQUIRED or INSUFFICIENT_SCOPE.

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)