---
title: "Create an API key"
method: POST
path: "/api/v1/keys"
tags: ["api-keys"]
---

# Create an API key

`POST /api/v1/keys`

## Request

- Base URL: `https://api.sytecheck.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sytecheck.app/api/v1/keys`
- Auth: HTTP bearer

Create an API key for programmatic access. **The secret is returned once, in this
response, and is never retrievable again.**

Requires an interactive session — an API key cannot create further keys.

Choose the narrowest `scopes` that work: `scans:read` alone cannot create or
delete scans, which makes it the safer credential for anything unattended.

## Request body

- ApiKeyCreate: Body for POST /api/v1/keys.
  - `label` string, required: Human-readable name to identify this key (e.g. 'CI pipeline').
  - `scopes` string[]: What this key may do: `scans:read`, `scans:write`. Defaults to all of them. A read-only key cannot spend scan quota, which is the safer choice for anything that runs unattended. Scopes never widen what a key can reach: account, billing, and key-management routes are closed to every key.

## Response `201`

Successful Response

- ApiKeyCreatedResponse: Returned only by key creation — includes the raw secret, shown once.
  - `id` integer, required
  - `label` string, required
  - `key_prefix` string, required
  - `scopes` string[]: What this key may do.
  - `is_active` boolean, required
  - `request_count` integer, required
  - `scan_count` integer, required
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable, required
  - `revoked_at` string, date-time, nullable, required
  - `api_key` string, required: The secret key. Store it now; it is never shown again.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sytecheck/apis/sytecheck-api.md) · [All operations](https://skmtc.dev/sytecheck/apis/sytecheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sytecheck/apis/sytecheck-api/revisions/797cf6b3e867?raw)