---
title: "Create an additional API key"
method: POST
path: "/v1/api-keys"
tags: ["API keys"]
---

# Create an additional API key

`POST /v1/api-keys`

## Request

- Base URL: `https://serp-agent.com`
- URL: `https://serp-agent.com/v1/api-keys`
- Auth: HTTP bearer

Mints a key of the **same mode** as the calling key (sandbox keys mint sandbox keys, live mint live) — a trial can never self-upgrade. Sandbox rotations inherit the calling key's expiry and usage ledger, so minting keys never extends or resets the trial budget. Max 5 active keys per account. The raw key appears only in this response. Empty body is valid (`name` is optional).

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `name` string

## Response `201`

Key created. `api_key` is the full raw key — shown exactly once.

- CreatedApiKey: ApiKey plus the raw secret — present only in the creation response.
  - `id` string, required
  - `name` string, nullable, required
  - `key_prefix` 'sk_sandbox_' | 'sk_live_', required
  - `last4` string, required
  - `mode` 'sandbox' | 'live', required
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable, required
  - `expires_at` string, date-time, nullable, required
  - `revoked_at` string, date-time, nullable, required
  - `api_key` string, required: Full raw key — shown exactly once.

## Other responses

- `400`: Malformed body (`invalid_request`) or 5 active keys already exist (`key_limit_reached`).
- `401`: Missing, malformed, unknown, revoked, or expired API key. Codes: `unauthorized`, `key_revoked`, `key_expired`.
- `429`: Rate limit exceeded (600 requests/minute per API key). Honor `Retry-After`.

---

[API](https://skmtc.dev/serp-agent/apis/serp-agent-api.md) · [All operations](https://skmtc.dev/serp-agent/apis/serp-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/serp-agent/apis/serp-agent-api/revisions/438a943019ac?raw)