---
title: "Mint an API key. The raw key is returned ONCE."
method: POST
path: "/api/v1/keys"
tags: ["API Keys"]
---

# Mint an API key. The raw key is returned ONCE.

`POST /api/v1/keys`

## Request

- Base URL: `https://qrlia.dev.castlesoft.eu`
- URL: `https://qrlia.dev.castlesoft.eu/api/v1/keys`
- Auth: API key in cookie `qrc_session`

## Request body

- object
  - `name` string, required: Human label for the key — shown in /settings.
  - `scope` 'tenant' | 'company', required: `tenant` keys see all companies in the tenant. `company` keys are pinned to one company.
  - `companyId` string, uuid: Required when scope='company'; forbidden when scope='tenant'.

## Response `201`

Created

- ApiKeyCreated
  - `id` string, uuid, required
  - `name` string, required
  - `prefix` string, required: Visible 12-char prefix (e.g. `qrc_abc123_…`). The full key is shown ONCE on creation.
  - `companyId` string, uuid, nullable, required
  - `createdAt` string, date-time, required
  - `lastUsedAt` string, date-time, nullable, required
  - `revokedAt` string, date-time, nullable, required
  - `key` string, required: The raw API key. Shown ONCE — store securely. Format: `qrc_<prefix>_<rand>`.

## Other responses

- `400`: Validation failed
- `401`: Authentication required
- `403`: Forbidden
- `404`: Not found
- `409`: Conflict
- `500`: Internal

---

[API](https://skmtc.dev/qrlia/apis/qrlia-api.md) · [All operations](https://skmtc.dev/qrlia/apis/qrlia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrlia/apis/qrlia-api/revisions/01c5dd6002ab?raw)