---
title: "Create a key"
method: POST
path: "/tyk/keys"
tags: ["Keys"]
---

# Create a key

`POST /tyk/keys`

Tyk will generate the access token based on the OrgID specified in the API Definition and a random UUID. This ensures that keys can be "owned" by different API Owners should segmentation be needed at an organisational level.
<br/><br/>
API keys without access_rights data will be written to all APIs on the system (this also means that they will be created across all SessionHandlers and StorageHandlers, it is recommended to always embed access_rights data in a key to ensure that only targeted APIs and their back-ends are written to.

## Request body

- SessionState — There's a data structure that's based on this and it's used for Protocol Buffer support, make sure to update "coprocess/proto/coprocess_session_state.proto" and generate the bindings using: cd coprocess/proto && ./update_bindings.sh
  - `tags` string[]
  - `access_rights` object
  - `alias` string
  - `allowance` number, double
  - `apply_policies` string[]
  - `apply_policy_id` string
  - `basic_auth_data` object
    - `hash_type` string
    - `password` string
  - `certificate` string
  - `data_expires` integer
  - `enable_detail_recording` boolean
  - `expires` integer
  - `hmac_enabled` boolean
  - `hmac_string` string
  - `id_extractor_deadline` integer
  - `is_inactive` boolean
  - `jwt_data` object
    - `secret` string
  - `last_check` integer
  - `last_updated` string
  - `meta_data` object
  - `monitor` object
    - `trigger_limits` number[]
  - `oauth_client_id` string
  - `oauth_keys` object
  - `org_id` string
  - `per` number, double
  - `quota_max` integer
  - `quota_remaining` integer
  - `quota_renewal_rate` integer
  - `quota_renews` integer
  - `rate` number, double
  - `session_lifetime` integer
  - `throttle_interval` number, double
  - `throttle_retry_limit` integer

## Response `200`

New Key added

- ApiModifyKeySuccess — apiModifyKeySuccess represents when a Key modification was successful
  - `action` string
  - `key` string — in:body
  - `key_hash` string
  - `status` string

## Other responses

- `400` — Malformed data

## Changes

- **2022-05-24** `111d8ca21864` — 20 breaking, 17 warning, 5 info
  - the request property `access_rights` became not nullable
  - the request property `access_rights/additionalProperties/allowed_urls` became not nullable
  - the request property `access_rights/additionalProperties/allowed_urls/items/methods` became not nullable
  - the request property `access_rights/additionalProperties/versions` became not nullable
  - …38 more

[Change history](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/changes/tyk/keys/post.md)

---

[API](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api.md) · [All operations](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tyktechnologies/tyk-gateway-api/revisions/abb30dca1f8d/schema)