---
title: "Create a service-account API key"
method: POST
path: "/orgs/{orgName}/service-accounts/{serviceAccountName}/api-keys"
tags: ["ApiKeys"]
---

# Create a service-account API key

`POST /orgs/{orgName}/service-accounts/{serviceAccountName}/api-keys`

## Request

- Base URL: `https://api.signadot.com/api/v2`
- URL: `https://api.signadot.com/api/v2/orgs/{orgName}/service-accounts/{serviceAccountName}/api-keys`
- Auth: API key in header `signadot-api-key`

Create an API key bound to a service account (admin only). The token is returned once.

## Path parameters

- `orgName` string, required
- `serviceAccountName` string, required

## Request body

- CreateApiKeyRequest
  - `description` string: Description is an optional human-readable description.
  - `expiresAt` string: ExpiresAt is the key's expiration time (RFC3339 timestamp). Omitting the field, or sending an explicit JSON null, both mean the key never expires — so callers that predate this field keep their old behavior with no changes required.

## Response `200`

OK

- ApiKey
  - `createdAt` string
  - `description` string
  - `expiresAt` string: ExpiresAt is the key's expiration time (RFC3339), or nil if it never expires.
  - `id` string
  - `lastUsedAt` string
  - `maskedValue` string
  - `token` string

## Other responses

- `403`: Forbidden
- `404`: Not Found

## Changes

- **2026-06-16** `40d6198d7957`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/signadot/apis/signadot-api/changes/orgs/:orgName/service-accounts/:serviceAccountName/api-keys/post.md)

---

[API](https://skmtc.dev/signadot/apis/signadot-api.md) - [All operations](https://skmtc.dev/signadot/apis/signadot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signadot/apis/signadot-api/revisions/5e80b0f9c718?raw)