---
title: "Create an API key"
method: POST
path: "/v2/account/apikeys"
tags: ["Account"]
---

# Create an API key

`POST /v2/account/apikeys`

Creates a scoped API key and returns the secret **exactly once** — it is never readable again. Store it before closing the response; if it is lost, revoke the key and create another.

`scopes` is required and cannot be empty: a key with no scope reaches nothing. Pass exactly `["*"]` for full access, which also covers scopes added in the future. `resources` is optional and restricts the key to specific applications/databases — every id must belong to the account, and it is **immutable**: deleting an application does not remove its id from an existing key (an empty `resources` means *whole account*, so pruning it would silently promote the key).

**`resources` cannot be combined with `blob:read`/`blob:write`, nor with `["*"]`** (`CONFLICTING_RESOURCES`). Object storage belongs to the account and no object carries an application id, so the restriction has nothing to apply to there — a key holding both would have to ignore one half or the other. Use one key for the applications and another for object storage.

Manually created keys never expire. Keys issued through the client-authorization flow expire in 90 days.

Session token only — an API key cannot create API keys.

## Request body

- object
  - `name` string, required — Label shown in the panel. Cannot be "legacy" (reserved).
  - `scopes` string[], required
  - `resources` string[] — Application/database ids the key may touch. Omit for whole-account access.

## Response `200`

Key created. `api_key` is shown here and nowhere else, ever.

- object
  - `status` 'success', required
  - `response` object, required
    - `id` string, required
    - `api_key` string, required
    - `prefix` string, required
    - `scopes` string[], required
    - `resources` string[], required

## Other responses

- `400` — Validation failed (`INVALID_NAME`, `INVALID_SCOPES`, `INVALID_RESOURCES`, `INVALID_JSON_BODY`), `resources` was combined with a blob scope or `["*"]` (`CONFLICTING_RESOURCES`), an id in `resources` is not owned by the account (`RESOURCE_NOT_FOUND`), or the account is at its key cap (`APIKEY_LIMIT_REACHED`).
- `401` — This endpoint requires a session token (JWT). API keys are not accepted.
- `413` — The request body is larger than the maximum allowed size (100MB).
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)