---
title: "Mint an API key for a project"
method: POST
path: "/v1/projects/{id}/keys"
tags: ["projects"]
---

# Mint an API key for a project

`POST /v1/projects/{id}/keys`

## Request

- Base URL: `https://api.portproof.org`
- URL: `https://api.portproof.org/v1/projects/{id}/keys`
- Auth: HTTP bearer

The secret is shown once. A key can only grant scopes it holds itself. Requires an `Idempotency-Key` header (CONTRACT §1): the same key with the same body within 24 h replays the stored response; a different body returns 409 `idempotency_conflict`.

## Path parameters

- `id` string, required

## Request body

- object
  - `scopes` string[], required
  - `expires_at` string, date-time

## Response `201`

Default Response

- object
  - `id` string, required
  - `prefix` string, required
  - `secret` string, required
  - `scopes` string[], required

## Other responses

- `400`: Default Response
- `403`: Default Response
- `404`: Default Response

---

[API](https://skmtc.dev/portproof/apis/portproof-api.md) · [All operations](https://skmtc.dev/portproof/apis/portproof-api/llms.txt) · [OpenAPI document](https://skmtc.dev/portproof/apis/portproof-api/revisions/4143916c0fac?raw)