---
title: "Create API key"
method: POST
path: "/api-keys"
tags: ["API Keys"]
---

# Create API key

`POST /api-keys`

Creates a new API key scoped to the current organization. The full key value is returned **only once** — store it securely, as it cannot be retrieved again.

## Request body

- object
  - `name` string — Descriptive name for the key (defaults to 'API Key')
  - `expiresIn` integer — Expiration in seconds (e.g., 2592000 = 30 days). Omit for no expiry.
  - `scopes` string[] — What this key may do. Defaults to every scope except keys:write, which a key can never hold. `write` includes `read` for the same resource.

## Response `201`

API key created successfully

- object
  - `data` object, required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required — Key prefix (rb_xxx)
    - `enabled` boolean, required — False when the key is disabled (soft-revoked)
    - `createdAt` integer, required — Unix ms
    - `lastUsedAt` integer, nullable, required
    - `expiresAt` integer, nullable, required
    - `key` string, required — Full API key value (rb_xxx...). Only returned once!
    - `scopes` string[], required — What this key may do. Never more than the credential that created it.

## Other responses

- `401` — Unauthorized

## Changes

- **2026-08-31** `fafe355d0698` — 3 info
  - the security scope `keys:write` was added to the endpoint's security scheme `bearerAuth`
  - added the new optional request property `scopes`
  - added the required property `data/scopes` to the response with the `201` status
- **2026-08-29** `4d10ec4266ee` — 1 info
  - api operation id `createApiKey` was added

[Change history](https://skmtc.dev/rendobar/apis/rendobar-api/changes/api-keys/post.md)

---

[API](https://skmtc.dev/rendobar/apis/rendobar-api.md) · [All operations](https://skmtc.dev/rendobar/apis/rendobar-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rendobar/apis/rendobar-api/revisions/fc5ca5f06d15?raw)