---
title: "Create an API key"
method: POST
path: "/api-keys"
tags: ["api-keys"]
---

# Create an API key

`POST /api-keys`

Issues a new API key with the requested scopes. The plaintext key is returned only in this response and cannot be retrieved afterwards.

Required scope: \`apikeys:issue\`

The issued key is always weaker than the caller: the requested scopes must be a subset of the scopes held by the calling key, \`apikeys:issue\` itself cannot be granted, and \`external\_data:\*\` scopes are not issuable through this endpoint (they require dashboard sign-in).

This endpoint accepts API key authentication only. Issuing from the dashboard is done in the console, which is also the only way to grant \`apikeys:issue\` and \`external\_data:\*\`.

## Request body

- CreateApiKeyRequest
  - `name` string, required — Name of the API key
  - `description` string — Description of the API key
  - `scopes` IssuableApiKeyScope[], required — Scopes granted to the issued key. Must be a subset of the caller's scopes.

## Response `201`

API key created

- CreatedApiKey
  - `id` string, required — API key ID
  - `name` string, required — Name of the API key
  - `description` string — Description of the API key
  - `key` string, required — Plaintext API key. Returned only at creation time.
  - `scopes` IssuableApiKeyScope[], required — Scopes granted to this key
  - `creation_time` integer, required — Creation time (Unix timestamp in seconds)

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.dev/qlonolink/apis/qaip-apis.md) · [All operations](https://skmtc.dev/qlonolink/apis/qaip-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/qlonolink/qaip-apis/revisions/61dc40676905/schema)