---
title: "Create a personal credential"
method: POST
path: "/v1/me/api-keys"
tags: ["Me"]
---

# Create a personal credential

`POST /v1/me/api-keys`

## Request

- Base URL: `https://api.roark.ai`
- URL: `https://api.roark.ai/v1/me/api-keys`
- Auth: HTTP bearer

Mints a credential that acts as you, for a CLI or an automation. The key value is returned exactly once, in the `key` field: capture it now, it is unreadable afterwards. Requires a personal credential (a project API key is refused) and admin on the project the credential defaults to. The new credential can never exceed the one that created it: not in scope, not in permissions, and not in lifetime. Omit a field to copy it from the calling credential.

## Request body

- CreateMyApiKeyInput: A personal credential to mint for the caller
  - `name` string, required: A label you will recognise later. It is the only thing that tells two credentials apart in the list you revoke from.
  - `projectId` string: Project the credential assumes when a request sends no X-Roark-Project-Id header. Defaults to the calling credential's own default project. You must be an admin of whichever project is used.
  - `scopes` string[]: Coarse tier. Defaults to the calling credential's own tier, and can never exceed it: a READ credential cannot mint a WRITE one.
  - `permissions` string[]: Granular 'resource:action' permissions. Defaults to the calling credential's own set, and can never exceed it. A ceiling, not an entitlement: the holder still only reaches what their project membership allows.
  - `expiresAt` string, date-time: ISO 8601 expiry. Defaults to the calling credential's own expiry (no expiry, for a `roark auth login` credential) and may not outlive it, so a short-lived connector credential cannot mint a permanent one.

## Response `200`

The created credential, with its key value (returned only here)

- object
  - `data` CreateMyApiKeyResponse, required: The created credential, with its key
    - `id` string, required: Roark ID of the credential. Pass it to DELETE to revoke.
    - `name` string, required: The label chosen when it was created
    - `createdAt` string, required: ISO 8601 timestamp
    - `lastUsedAt` string, nullable, required: ISO 8601 timestamp, null if never used
    - `expiresAt` string, nullable, required: ISO 8601 timestamp, null if it never expires
    - `status` 'ACTIVE' | 'REVOKED', nullable, required
    - `organizationId` string, nullable, required: The organization this credential is pinned to
    - `defaultProjectId` string, nullable, required: The project a request acts on when it sends no X-Roark-Project-Id header. Null once that project is deleted.
    - `scopes` string[], required: Coarse tier: READ, or WRITE for read and write
    - `permissions` string[], required: Granted 'resource:action' permissions
    - `key` string, required: The credential value. Returned only here, only once.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too Many Requests
- `500`: Internal Server Error

## Changes

> 188 revisions in range; 1 not diffed.

- **2026-10-09** `e7b6b5cc7fa6`: 1 breaking, 11 info
  - the `data` response's property type changed from no type to `object` for status `200`
  - removed `#/components/schemas/MeApiKey` from the `data` response property `allOf` list for the response status `200`
  - added the required property `data/createdAt` to the response with the `200` status
  - added the required property `data/defaultProjectId` to the response with the `200` status
  - …8 more
- **2026-10-05** `a410c3d1543c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/roarkhq/apis/roark-analytics-api/changes/v1/me/api-keys/post.md)

---

[API](https://skmtc.dev/roarkhq/apis/roark-analytics-api.md) - [All operations](https://skmtc.dev/roarkhq/apis/roark-analytics-api/llms.txt) - [OpenAPI document](https://skmtc.dev/roarkhq/apis/roark-analytics-api/revisions/1a91a5c90e44?raw)