---
title: "Create a developer API key"
method: POST
path: "/api/settings/developer/api-keys"
tags: ["API keys"]
---

# Create a developer API key

`POST /api/settings/developer/api-keys`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/settings/developer/api-keys`
- Auth: API key in cookie `luca.session_token`

Mints a key and returns the raw secret exactly once, with ready-to-run examples. A key can never carry more than the person minting it already holds, so we check each requested scope against the caller's permissions in every target workspace. Capability and data-sensitivity tiers default to least privilege when you leave them out.

**Session-only.** This endpoint isn't on the API-key allowlist. An organization API key gets a 403 here, whatever scopes it holds.

## Headers

- `Luca-API-Version` '1'

## Request body

- DeveloperApiKeyCreate
  - `name` string, required
  - `scopes` string[], required
  - `workspaceMode` 'current' | 'selected' | 'all'
  - `workspaceIds` string[]
  - `expiresInDays` integer, nullable
  - `rateLimitMax` integer
  - `capabilityTier` 'read' | 'draft' | 'queue_ops' | 'full'
  - `dataSensitivityTier` 'redacted' | 'full_content'

## Response `200`

ok

- DeveloperApiKeyCreateResponse
  - `apiKey` object, required
    - `id` string, required
    - `name` string, nullable, required
    - `prefix` string, nullable, required
    - `start` string, nullable, required
    - `scopes` string[], required
    - `capabilityTier` 'read' | 'draft' | 'queue_ops' | 'full', required
    - `dataSensitivityTier` 'redacted' | 'full_content', required
    - `workspaceIds` string[], required
    - `workspaceMode` 'current' | 'selected' | 'all', required
    - `createdByUserId` string, nullable, required
    - `rateLimitEnabled` boolean, required
    - `rateLimitMax` integer, nullable, required
    - `rateLimitTimeWindow` integer, nullable, required
    - `remaining` integer, nullable, required
    - `lastUsedAt` string, nullable, required
    - `expiresAt` string, nullable, required
    - `revokedAt` string, nullable, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `createdAt` string, required
    - `updatedAt` string, required
  - `key` string, required
  - `examples` object, required
    - `xApiKey` string, required
    - `authorization` string, required
    - `workspace` string, required
    - `idempotentWrite` string, required

## Other responses

- `400`: bad request
- `401`: unauthorized
- `403`: forbidden
- `429`: rate limited
- `500`: internal error
- `503`: service unavailable

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)