---
title: "Create Api Key"
method: POST
path: "/create-api-key"
tags: ["api-keys"]
---

# Create Api Key

`POST /create-api-key`

Create a new API key for the authenticated user.

Only JWT-authenticated (browser session) requests are permitted — API key
creation via an existing API key is blocked to prevent credential chaining.

Args:
    request: The incoming FastAPI request (used by SlowAPI rate limiter).
    body: The API key creation request payload.
    auth: The authenticated user context.

Returns:
    CreateAPIKeyResponse with the secret key (shown only once).

Raises:
    HTTPException: 403 if called via API key or the active team's key cap
        is zero, 409 if the cap is already reached, 500 for unexpected
        failures.

## Request body

- CreateAPIKeyRequest — Request model for creating an API key. Attributes: name: User-visible identifier for the key. expires_at: Optional ISO-8601 expiry; sentinels (``""``, ``never``, ``none``, ``null``) collapse to ``None``. team_id: Tenant the key is bound to. ``None`` defaults to the caller's active team; an explicit value must equal it. captcha_token: hCaptcha response token for bot verification.
  - `name` string, required — Name for the API key
  - `expires_at` string, nullable — Optional expiration timestamp (ISO 8601). Sentinel strings like 'never' are accepted and treated as no expiration.
  - `team_id` string, nullable — Team to bind the key to. Defaults to the caller's active team when omitted; an explicit value must equal the active team.
  - `captcha_token` string, nullable — hCaptcha response token for bot verification

## Response `200`

Successful Response

- CreateAPIKeyResponse — Response model for API key creation.
  - `id` string, required
  - `name` string, required
  - `api_key_last_digits` string, required
  - `created_at` string, required
  - `expires_at` string, nullable
  - `team_id` string, required
  - `secret_key` string, required
  - `stripe_customer_created` boolean

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-24** `1cffaad2a921` — 1 warning, 1 info
  - removed the optional property `detail` from the response with the `422` status
  - added the required property `error` to the response with the `422` status

[Change history](https://skmtc.dev/pioneer/apis/brain-api/changes/create-api-key/post.md)

---

[API](https://skmtc.dev/pioneer/apis/brain-api.md) · [All operations](https://skmtc.dev/pioneer/apis/brain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pioneer/apis/brain-api/revisions/1cffaad2a921?raw)