---
title: "Create an API key"
method: POST
path: "/v1/api-keys"
tags: ["API keys"]
---

# Create an API key

`POST /v1/api-keys`

## Request

- Base URL: `https://api.rumoro.dev`
- URL: `https://api.rumoro.dev/v1/api-keys`
- Auth: HTTP bearer

Issues a new API key in this workspace. The key is shown only in this response, and only its hash is stored. `expiresAt` makes it stop working at a set time, useful for a contractor or a one-off script. An expired key stays in the list until you revoke it.

## Request body

- object
  - `name` string: A name for the key. Defaults to "default".
  - `scope` 'read' | 'write': write can do everything. read is limited to GET.
  - `expiresAt` string, date-time: Expiry time in ISO 8601 or epoch ms, later than now. Set it for keys you hand to a script or contractor. Omit it or send null and the key never expires.

## Response `201`

The created key, visible only now

- object
  - `id` string, required: The key's id (key_...).
  - `name` string, required
  - `prefix` string, required: The start of the key, so you can tell keys apart.
  - `scope` 'read' | 'write', required: write can do everything. read is limited to GET.
  - `createdAt` string, required: UTC time in ISO 8601.
  - `lastUsedAt` string, nullable, required: UTC time in ISO 8601.
  - `expiresAt` string, nullable, required: When the key expires. Null for a key without expiry. Expired keys stay in the list until revoked.
  - `key` string, required: The complete key. It is only shown here, so save it now.

## Other responses

- `400`: expiresAt must be a future time
- `401`: The API key is missing or not valid

---

[API](https://skmtc.dev/rumoro/apis/rumoro-api.md) · [All operations](https://skmtc.dev/rumoro/apis/rumoro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rumoro/apis/rumoro-api/revisions/9ef63ea894d1?raw)