---
title: "Create an API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Create an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://api.postzen.dev`
- URL: `https://api.postzen.dev/v1/api-keys`
- Auth: HTTP bearer

Creates an API key and returns the full key value exactly once. This endpoint requires a read-write API key with access to all profiles; profile-scoped keys receive a `403`. Store the returned `key` securely — it cannot be retrieved again after this response.

## Request body

- ApiKeyCreateRequest
  - `name` string, required: Human-readable label for the key.
  - `scope` 'full' | 'profiles': `full` grants access to all profiles; `profiles` restricts the key to `profileIds`.
  - `profileIds` string[]: PostZen profile ids. Required when `scope` is `profiles`, and forbidden when `scope` is `full`.
  - `permission` 'read-write' | 'read': `read` keys may only call `GET` endpoints.

## Response `201`

API key created.

- ApiKeyCreateResponse
  - `message` string, required
  - `apiKey` ApiKeyWithSecret, required
    - `id` string, required: API key id.
    - `name` string, required: Human-readable label.
    - `keyPreview` string, required: Masked preview of the key, for example `pzn_live_a1b2c3d4e...`. The full key is never retrievable after creation.
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required: Last time the key authenticated a request, or `null` if it has never been used.
    - `scope` 'full' | 'profiles', required: `full` grants access to all profiles; `profiles` restricts the key to `profileIds`.
    - `profileIds` ApiKeyProfileRef[], required: Profiles the key is restricted to. Empty for full-scope keys.
      - `_id` string, required: PostZen profile id.
      - `name` string, required
      - `color` string, required: Hex color in `#rrggbb` format.
    - `permission` 'read-write' | 'read', required: `read` keys may only call `GET` endpoints; `read-write` keys may call every endpoint.
    - `key` string, required: The full API key. Shown only once in the create response — store it securely, as it cannot be retrieved again.

## Other responses

- `400`: Invalid request.
- `401`: Missing or invalid API key.
- `403`: The API key does not have sufficient permission or profile access.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/postzen/apis/postzen-public-api.md) · [All operations](https://skmtc.dev/postzen/apis/postzen-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postzen/apis/postzen-public-api/revisions/40863e3710ec?raw)