---
title: "Create an API key"
method: POST
path: "/api/v1/keys"
---

# Create an API key

`POST /api/v1/keys`

## Request

- Base URL: `https://prowl.chat`
- URL: `https://prowl.chat/api/v1/keys`
- Auth: HTTP bearer

Mints a `prowl_...` key, optionally scoped to categories, spend limits and an IP allowlist. **The secret is returned once and is never retrievable again** — store it when you receive it.

## Headers

- `authorization` string, nullable

## Cookies

- `prowl_session` string, nullable

## Request body

- CreateMCPKeyRequest: POST /api/mcp/keys body.
  - `name` string
  - `allowed_categories` string[]
  - `denied_categories` string[]
  - `daily_spend_limit_usd` number, nullable
  - `total_spend_limit_usd` number, nullable
  - `ip_allowlist` string[]

## Response `200`

Successful Response

- ApiKeyCreatedResponse: The one response that carries the raw key — it is never retrievable again.
  - `id` string, required
  - `key` string, required: The secret. Shown exactly once; store it now.
  - `prefix` string, required
  - `name` string, required
  - `allowed_categories` string[], nullable
  - `denied_categories` string[], nullable
  - `daily_spend_limit_usd` number, nullable
  - `total_spend_limit_usd` number, nullable
  - `ip_allowlist` string[], nullable

## Other responses

- `401`: Missing, malformed or expired credential.
- `422`: Validation Error

---

[API](https://skmtc.dev/prowl/apis/prowl-rest-api-v1.md) · [All operations](https://skmtc.dev/prowl/apis/prowl-rest-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/prowl/apis/prowl-rest-api-v1/revisions/897e8b30c330?raw)