---
title: "Create organization API key"
method: POST
path: "/v1/management/api-keys"
tags: ["Management"]
---

# Create organization API key

`POST /v1/management/api-keys`

## Request

- Base URL: `https://api.tokenlab.sh`
- URL: `https://api.tokenlab.sh/v1/management/api-keys`
- Auth: HTTP bearer

Creates a new user API key for the current organization management token.

## Request body

- object
  - `name` string, required: Display name for the user API key. Trimmed server-side. Length must be 1-50 characters.
  - `limitAmount` number, nullable: Spending limit input in USD. `null` or omitted means unlimited usage, and `0` means zero quota.
  - `limitCurrency` 'USD': Currency for `limitAmount`. USD is the only active currency. Sending `CNY` returns 400 `currency_retired`.
  - `models` string[]: Optional model allowlist. Empty array means no per-key model restriction beyond organization policy.
  - `expiresAt` string, date-time, nullable: Optional RFC3339 timestamp. null means no expiry.
  - `deliveryPolicy` 'auto' | 'verified' | 'official' | 'null', nullable: Per-key Delivery policy. null inherits the Workspace default.

## Response `201`

Created API key

- ManagementCreatedApiKey
  - `id` string, required
  - `name` string, required
  - `key_prefix` string, required
  - `status` 'active' | 'inactive' | 'suspended' | 'revoked', required: Lifecycle status for the user API key: active, inactive, or revoked.
  - `limit_amount` number, nullable, required: API key spending cap in USD as a JSON number for display. null means unlimited.
  - `used_amount` number, required: Accumulated API key usage in USD as a JSON number for display.
  - `models` string[], required
  - `expires_at` string, date-time, nullable, required
  - `last_used_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `key` string, required: Full secret API key value returned only on creation. Store it immediately.
  - `limit_amount_decimal` string, nullable, required: Exact API key spending cap in USD as a decimal string. null means unlimited.
  - `used_amount_decimal` string, required: Exact accumulated API key usage in USD as a decimal string for reconciliation.
  - `delivery_policy` 'auto' | 'verified' | 'official' | 'null', nullable, required: Per-key Delivery policy. null inherits the Workspace default.

## Other responses

- `400`: Bad Request - Invalid input
- `401`: Unauthorized - Invalid or missing API key
- `403`: Forbidden

---

[API](https://skmtc.dev/tokenlab/apis/tokenlab-ai-gateway.md) · [All operations](https://skmtc.dev/tokenlab/apis/tokenlab-ai-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/tokenlab/apis/tokenlab-ai-gateway/revisions/3208bfbcda22?raw)