---
title: "Create API Key"
method: POST
path: "/apiKeys"
tags: ["API Keys"]
---

# Create API Key

`POST /apiKeys`

## Request

- Base URL: `https://eu-west-1.api.silverflow.com/v1`
- URL: `https://eu-west-1.api.silverflow.com/v1/apiKeys`
- Auth: one of:
  - HTTP basic
  - HTTP bearer
- TypeScript: <https://skmtc.dev/silverflow/apis/silverflow-api/docs/apiKeys/post.ts> (a function with typed inputs; its response is checked against the schema)

This operation creates a new API key with the specified permissions.
When the `status` is set to `active` the API Key is immediately usable.

Requires `apiKeys:Create` permission.

## Request body

- ApiKeyCreate
  - `status` 'disabled' | 'active' | 'archived': The status of an API Key
  - `description` string
  - `permissions` Permission[], required
  - `ipRanges` IpRange[]: A list of IP ranges

## Response `201`

The created API Key

- ApiKey: An Agent represents a Silverflow customer
  - `key` string, required: Uniquely identifies an API Key
  - `status` 'disabled' | 'active' | 'archived', required: The status of an API Key
  - `agentKey` string, required: Uniquely identifies an Agent
  - `description` string
  - `permissions` Permission[], required
  - `ipRanges` IpRange[]: A list of IP ranges
  - `mtlsEnabled` boolean: Whether this API Key requires mTLS. It is `false` unless it was enabled, and it can't be set back to `false`. <a class="experimental-tag-link" href="https://docs.silverflow.com/guides/api-lifecycle#tag/EXPERIMENTAL-Tag"><span class="tag experimental-tag">EXPERIMENTAL</span></a>
  - `certificates` ApiKeyCertificate[]: The client certificates bound to this API Key. At most two can be active at the same time. <a class="experimental-tag-link" href="https://docs.silverflow.com/guides/api-lifecycle#tag/EXPERIMENTAL-Tag"><span class="tag experimental-tag">EXPERIMENTAL</span></a>
    - `certificateKey` string, required: Uniquely identifies a certificate bound to an API Key
    - `fingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
    - `notBefore` string, date-time, required: The start of the certificate's validity period, taken from the certificate
    - `notAfter` string, date-time, required: The end of the certificate's validity period, taken from the certificate
    - `description` string
    - `created` string, date-time, required: The date and time this object was created
    - `trustAnchorFingerprint` string, required: The SHA-256 hash of the DER-encoded certificate, as URL-safe base64 with padding (44 characters, using `-` and `_`, ending in `=`). This is the value of the `CloudFront-Viewer-Cert-Sha256` header for the certificate. To compute it from a certificate file: `openssl x509 -in cert.pem -outform der | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_'`.
    - `status` 'active' | 'archived', required: The status of the certificate. Archived certificates stay in the list.
  - `secret` string: The secret part of this API Key. This value will only be returned upon creation. It cannot be changed afterwards.
  - `created` string, date-time, required: The date and time this object was created
  - `lastModified` string, date-time: The date and time this object was last modified
  - `version` integer, required: The version of this object

## Other responses

- `400`: The request was malformed. See the response body for details
- `401`: Authentication information is missing or invalid
- `403`: The authenticated client is forbidden to make the request for the resource identified.
- `409`: The request could not be completed due to a conflict with the current state of the resources involved in the request.
- `429`: The number of requests (per minute) has exceeded the configured maximum

---

[API](https://skmtc.dev/silverflow/apis/silverflow-api.md) - [All operations](https://skmtc.dev/silverflow/apis/silverflow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/silverflow/apis/silverflow-api/revisions/43ecbe4fd6ea?raw)