---
title: "Create an agent key"
method: POST
path: "/api/v1/inboxes/{id}/keys"
tags: ["Agent inboxes"]
---

# Create an agent key

`POST /api/v1/inboxes/{id}/keys`

## Request

- Base URL: `https://supermailos.com`
- URL: `https://supermailos.com/api/v1/inboxes/{id}/keys`
- Auth: HTTP bearer

A key that reaches this one agent inbox and nothing else (owner/admin). The secret is in the answer, this once.

## Path parameters

- `id` string, required

## Request body

- AgentKeyRequest
  - `name` string
  - `scopes` string[]
  - `expiresInDays` integer: No expiry when omitted.

## Response `201`

Created.

- object
  - `key` AgentKey, required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: Non-secret leading characters.
    - `scopes` string[], required
    - `inboxId` string, required
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time
    - `expiresAt` string, date-time
    - `revokedAt` string, date-time
    - `secret` string: Only when it was just created: the key itself (`smk_…`). Shown once.

## Other responses

- `400`: The request is malformed.
- `401`: Missing, invalid or revoked API key.
- `403`: The key lacks the scope (`missing_scope`) or the access (`forbidden`).
- `404`: Not found — or not reachable with this key.
- `429`: Too many requests.

---

[API](https://skmtc.dev/supermailos/apis/supermailos-api.md) · [All operations](https://skmtc.dev/supermailos/apis/supermailos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supermailos/apis/supermailos-api/revisions/5bd0ce2ee269?raw)