---
title: "Create an API key"
method: POST
path: "/api/temporary-keys/"
tags: ["temporaryApiKeys"]
---

# Create an API key

`POST /api/temporary-keys/`

Create a new API key.

## Headers

- `Authorization` string, required

## Request body

- object
  - `name` string — Key name.
  - `expiry_date` string, date-time — Expiry date (ISO 8601).
  - `max_usage` integer — Max usage count. -1 = unlimited.
  - `rate_limit` integer — Calls per minute. Overridden by plan limit.
  - `spending_limit` number, double — Spending limit in USD for gateway usage.
  - `is_test` boolean — Test key (`true`) or production key (`false`).
  - `limit_policies` APIKeyLimitPolicySpec[] — Optional. Spending, token, or request caps to create and scope to this key in the same call. The response echoes the created policies in full (each with its `id`, `meter_definition_id`, and `current_state`). Caps are stored and visible as soon as they are created, but the gateway enforces them only where the limit system is enabled for your environment. Where it is not enabled, a cap records no usage and never blocks.
    - `max_value` number, double, required — The cap, in the unit named by `metric`. The counter blocks when it reaches this value: `max_value` of 3 on `request_count` allows two requests and refuses the third.
    - `metric` 'cost' | 'request_count' | 'token_count' — What the cap counts. `cost` is US dollars, `token_count` is total tokens, `request_count` is calls.
    - `period` string, required — A named bucket (`minute`, `hour`, `day`, `week`, `month`) or a positive integer of seconds as a string. A lifetime (`null`) period is rejected here; use `POST /api/limit-policies/` for that.
    - `warning_threshold` number, double, nullable — Optional soft threshold; must be strictly below `max_value`. Fires an alert without blocking.
    - `name` string — Display label. When blank, the dashboard falls back to the key's own name.
    - `notification_method_id` string, nullable — OrganizationNotificationMethod id to ping when a rule trips. Must belong to the same project.

## Response `201`

Created API key.

- TemporaryAPIKeysCreateApiKeyResponse201
  - `id` string — API key ID.
  - `name` string — Key name.
  - `prefix` string — Key prefix.
  - `is_test` boolean — Test or production key.
  - `expiry_date` string, date-time — Expiry date.
  - `max_usage` integer — Max usage count. -1 = unlimited.
  - `rate_limit` number, double, nullable — Requests per minute. null uses the organization default.
  - `spending_limit` number, double — Spending limit in USD.
  - `api_key` string — The API key value. Only returned on creation - store it securely.
  - `key_usage` integer — Number of times this key has been used.
  - `created` string, date-time — When the API key was created.
  - `unique_organization_id` string, nullable — Owning organization UUID.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.dev/respan/apis/api-reference.md) · [All operations](https://skmtc.dev/respan/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/respan/api-reference/revisions/764fca4d43e4/schema)