---
title: "Create API key"
method: POST
path: "/v1/api-keys"
tags: ["API Keys"]
---

# Create API key

`POST /v1/api-keys`

## Request

- Base URL: `https://smtpfa.st/api`
- URL: `https://smtpfa.st/api/v1/api-keys`
- Auth: HTTP bearer

Generate a new API key. The full key value is returned only once in the response. Store it securely.

## Request body

- CreateApiKeyRequest
  - `name` string, required: A human-readable name for the key
  - `scopes` string[]: Optional list of scopes to restrict the key. Available: email:send, email:read, domain:read, domain:write, contact:read, contact:write, form:read, form:write, webhook:read, webhook:write, logs:read, inbound:read, inbound:delete, team:read, team:manage, apikey:manage. If omitted the key gets the default set: everything except logs:read, inbound:read, inbound:delete, team:read, team:manage and apikey:manage. Listing, creating or revoking keys through the API requires apikey:manage.

## Response `200`

API key created (includes the full key value)

- ApiKeyCreated: Returned when a new API key is created. The key field contains the full secret and is only shown once.
  - `id` string
  - `name` string
  - `key` string
  - `prefix` string
  - `scopes` string[]
  - `created_at` string, date-time

## Other responses

- `400`: Bad request - check your payload
- `401`: Invalid or missing API key
- `429`: Rate limit exceeded - retry after the period indicated in the Retry-After header
- `500`: Internal server error

---

[API](https://skmtc.dev/smtpfa/apis/smtpfast-api.md) · [All operations](https://skmtc.dev/smtpfa/apis/smtpfast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/smtpfa/apis/smtpfast-api/revisions/79dda742f53e?raw)