---
title: "Create a key."
method: POST
path: "/tyk/keys"
tags: ["Keys"]
---

# Create a key.

`POST /tyk/keys`

Tyk will generate the access token based on the OrgID specified in the API Definition and a random UUID. This ensures that keys can be owned by different API Owners should segmentation be needed at an organisational level.
 <br/><br/>
  API keys without access_rights data will be written to all APIs on the system (this also means that they will be created across all SessionHandlers and StorageHandlers, it is recommended to always embed access_rights data in a key to ensure that only targeted APIs and their back-ends are written to.

## Query parameters

- `hashed` boolean

## Request body

- SessionState
  - `access_rights` object, nullable
  - `alias` string
  - `allowance` number, double
  - `apply_policies` string[], nullable
  - `apply_policy_id` string — deprecated use apply_policies going forward instead to send a list of policies ids
  - `basic_auth_data` BasicAuthData
    - `hash_type` string
    - `password` string
  - `certificate` string
  - `data_expires` integer
  - `date_created` string, date-time
  - `enable_detail_recording` boolean — deprecated use enable_detailed_recording going forward instead
  - `enable_detailed_recording` boolean
  - `enable_http_signature_validation` boolean
  - `expires` integer
  - `hmac_enabled` boolean
  - `hmac_string` string
  - `id_extractor_deadline` integer
  - `is_inactive` boolean
  - `jwt_data` JWTData
    - `secret` string
  - `last_check` integer
  - `last_updated` string
  - `max_query_depth` integer
  - `meta_data` object, nullable
  - `monitor` Monitor
    - `trigger_limits` number[], nullable
  - `oauth_client_id` string
  - `oauth_keys` object, nullable
  - `org_id` string
  - `per` number, double
  - `post_expiry_action` 'retain' | 'delete' — Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
  - `post_expiry_grace_period` integer — Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
  - `quota_max` integer
  - `quota_remaining` integer
  - `quota_renewal_rate` integer
  - `quota_renews` integer
  - `rate` number, double
  - `rsa_certificate_id` string
  - `session_lifetime` integer
  - `smoothing` RateLimitSmoothing, nullable
    - `delay` integer
    - `enabled` boolean
    - `step` integer
    - `threshold` integer
    - `trigger` number
  - `tags` string[], nullable
  - `throttle_interval` number, double
  - `throttle_retry_limit` integer

## Response `200`

New key added.

- ApiModifyKeySuccess
  - `action` string
  - `key` string
  - `key_hash` string
  - `status` string

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `500` — Internal server error.

## Changes

- **2026-04-08** `dd3336b65081` — 2 info
  - added the new optional request property `post_expiry_action`
  - added the new optional request property `post_expiry_grace_period`
- **2025-11-13** `59da626fc82d` — 2 breaking
  - removed the enum value `false` from the `query` request parameter `hashed`
  - removed the enum value `true` from the `query` request parameter `hashed`
- **2025-02-07** `3d8e4f5b3dab` — 3 info
  - the request property `access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing` became nullable
  - the request property `access_rights/additionalProperties/limit/smoothing` became nullable
  - the request property `smoothing` became nullable
- **2024-09-18** `111affa17abe` — 1 breaking, 1 warning, 46 info
  - the `meta_data/additionalProperties/` request property type/format changed from `object`/`` to ``/``
  - removed the request property `access_rights/additionalProperties/limit/set_by_policy`
  - added the new optional `query` request parameter `hashed`
  - added the new optional request property `access_rights/additionalProperties/allowance_scope`
  - …44 more
- **2024-08-21** `31989871353c` — 1 warning, 1 info
  - removed the request property `access_rights/additionalProperties/limit/smoothing`
  - added the new optional request property `access_rights/additionalProperties/endpoints`

[Full history](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/changes/tyk/keys/post.md)

---

[API](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api.md) · [All operations](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tyktechnologies/tyk-gateway-api/revisions/900d0a33ae1d/schema)