---
title: "Create an API key for the active organization (session only, owner/admin)"
method: POST
path: "/v1/api-keys"
tags: ["discovery"]
---

# Create an API key for the active organization (session only, owner/admin)

`POST /v1/api-keys`

## Request

- Base URL: `https://postbag.dev`
- URL: `https://postbag.dev/v1/api-keys`
- Auth: HTTP bearer

Requires a signed-in dashboard session, not another API key — an agent cannot mint its own first key this way. Owner or admin (job L). The full key is only ever returned once, in this response; store it immediately.

## Request body

- object
  - `name` string: A label to tell keys apart, e.g. 'CI deploy key'. Maximum 32 characters.
  - `scopes` string[]: manage ⊇ read ⊇ submit — a manage key satisfies every read- or submit-scoped call too.

## Response `201`

created

- object
  - `id` string, required
  - `name` string, nullable, required
  - `prefix` string, nullable, required
  - `scopes` string[], required
  - `key` string, required
  - `created_at` string, required

## Other responses

- `400`: Error
- `401`: Error
- `403`: Error
- `404`: Not found
- `409`: Error
- `422`: Error

---

[API](https://skmtc.dev/postbag/apis/postbag-api.md) · [All operations](https://skmtc.dev/postbag/apis/postbag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postbag/apis/postbag-api/revisions/3da976524695?raw)