---
title: "Create a publishable key"
method: POST
path: "/api/v1/serving-identity/keys"
tags: ["authed"]
---

# Create a publishable key

`POST /api/v1/serving-identity/keys`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/serving-identity/keys`
- Auth: none declared

Create a publishable key for one of this organization's agents —
its turns run that agent's published revision. The response carries
the full key, and so does every later listing: a publishable key is
public, so it is always copyable.

## Request body

- CreatePublishableKeyRequest
  - `mode` 'live' | 'test', required
  - `allowed_origins` string[], required: Every web origin the assistant will run on, scheme and host only, like https://app.example.com or http://localhost:3000. They can't be changed after the key is created, so include local, staging and production origins now.
  - `agent_definition_id` string, uuid, required: The agent the key serves. The assistant answers only once that agent has a published version.

## Response `201`

Successful Response

- CreatedPublishableKeyResponse: The create and rotate answer: the same shape with the key guaranteed present — a freshly built row always carries it.
  - `id` string, uuid, required: The key's id.
  - `key_prefix` string, required: The key's first characters, to recognize it.
  - `key` string, required: The full publishable key, safe in page source: it names the organization and agent, and grants nothing on its own.
  - `mode` 'live' | 'test', required
  - `allowed_origins` string[], required: The only web origins the key answers requests from. Fixed when the key is created.
  - `status` 'active' | 'revoked', required
  - `revoked_at` string, date-time, nullable, required: When the key was revoked; null while it is active.
  - `last_used_at` string, date-time, nullable, required: When a visitor last started a session with the key; null until the assistant is first opened with it.
  - `created_at` string, date-time, required: When the key was created.
  - `agent_definition_id` string, uuid, nullable, required: The agent this key serves: conversations started with it run that agent's published version.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

## Changes

- **2026-11-03** `c6ac9fd6657f`: 6 info
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `401`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `403`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `404`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `405`
  - …2 more

[Operation history](https://skmtc.dev/teaflask/apis/teaflask-api/changes/api/v1/serving-identity/keys/post.md)

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/c6ac9fd6657f?raw)