---
title: "Create Api Key"
method: POST
path: "/v1/orgs/{org_id}/api-keys"
tags: ["api-keys"]
---

# Create Api Key

`POST /v1/orgs/{org_id}/api-keys`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/orgs/{org_id}/api-keys`
- Auth: none declared

Create an API key. Org admins/owners: unchanged. A plain MEMBER may now
mint their OWN key (task 1851) — strictly self-scoped: never a scope beyond
their access, and never org-wide.

## Path parameters

- `org_id` string, required

## Request body

- ApiKeyCreateIn
  - `name` string, required
  - `scopes` string[]
  - `projects` string[]: Project UUIDs this key may act on. Empty (default) = ORG-WIDE (every project in the org).
  - `version_uuid` string, nullable: Optional: scope the key to a single project version. `null` (default) means all-versions. Requires exactly one entry in `projects`.
  - `env_type` 'prod' | 'dev': `prod` keys are not IP/origin gated (CDN-served reads only). `dev` keys can hit the runtime translation endpoint and MUST carry at least one `*` or specific entry in ip_allowlist OR origin_allowlist; empty + dev = key is unusable by design.
  - `ip_allowlist` string[]: CIDR or exact IPs (e.g. `1.2.3.4`, `10.0.0.0/8`, `*`). Enforced ONLY for env_type='dev' on the runtime endpoint.
  - `origin_allowlist` string[]: Exact origin URLs (e.g. `http://localhost:5173`, `https://app.sonenta.com`, `*`). Enforced for env_type='dev' on the runtime endpoint.
  - `expires_at` string, date-time, nullable

## Response `201`

Successful Response

- ApiKeyCreateOut: Returned ONCE on create / rotate — includes the full token.
  - `uuid` string, required
  - `prefix` string, required
  - `last4` string, required
  - `name` string, required
  - `scopes` string[], required
  - `projects` string[]
  - `org_wide` boolean
  - `version_uuid` string, nullable
  - `env_type` 'prod' | 'dev'
  - `ip_allowlist` string[]
  - `origin_allowlist` string[]
  - `created_by_uuid` string, nullable, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable, required
  - `revoked_at` string, date-time, nullable, required
  - `last_used_at` string, date-time, nullable, required
  - `secret` string, required
  - `token` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)