---
title: "Create API key"
method: POST
path: "/api-keys"
tags: ["API Keys"]
---

# Create API key

`POST /api-keys`

Creates a new API key for the authenticated customer. The secret key value is returned once — store it securely.

## Request body

- ApiKeyCreateRequest
  - `name` string, nullable — Friendly name for this key (e.g. "Production", "Staging").
  - `allowed_domains` string[], required — List of allowed origins/domains. Requests from other domains are rejected with 403.
  - `routing_strategy` 'economy' | 'performance', required — economy — most competitive prices; performance — fastest routes.

## Response `201`

API key created (secret returned once)

- ApiKeyCreatedResponse
  - `id` integer, required
  - `customer_id` integer, required
  - `allowed_domains` string[], required
  - `api_key` string, required — The secret API key. Save this — it is returned only once.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `name` string, nullable, required
  - `routing_strategy` 'economy' | 'performance', required
  - `active` boolean, required
  - `bypass_credit_check` boolean, required

## Other responses

- `400` — Bad request (invalid domains, routing strategy, or missing fields)
- `401` — Unauthorized
- `500` — Internal server error

## Changes

- **2026-07-06** `81fbe32d2100` — 1 info
  - endpoint added
- **2026-02-10** `919eb7a392aa` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/routemesh/apis/routemesh-api/changes/api-keys/post.md)

---

[API](https://skmtc.dev/routemesh/apis/routemesh-api.md) · [All operations](https://skmtc.dev/routemesh/apis/routemesh-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/routemesh/routemesh-api/revisions/ec927412b199/schema)