---
title: "Create an API key"
method: POST
path: "/api-keys"
tags: ["API keys"]
---

# Create an API key

`POST /api-keys`

## Request

- Base URL: `https://www.unitpost.com/api/v1`
- URL: `https://www.unitpost.com/api/v1/api-keys`
- Auth: HTTP bearer

Create an API key scoped to the capabilities you choose. The response includes the plaintext `key` exactly once — store it securely now, because it can never be retrieved again (only [revoked](#delete-api-keys-id)). This endpoint is session-gated: it requires a dashboard session and cannot be called with a Bearer API key.

## Request body

- ApiKeyCreate
  - `name` string, required
  - `scope` 'full' | 'sending' | 'read_only'
  - `capabilities` string[]

## Response `201`

Created — includes the one-time plaintext key.

- ApiKeyCreated
  - `object` 'api_key', required
  - `id` string, required
  - `name` string, required
  - `prefix` string, required
  - `scope` 'full' | 'sending' | 'read_only', required
  - `capabilities` string[], required
  - `last_used_at` string, nullable, required
  - `revoked_at` string, nullable, required
  - `created_at` string, required
  - `key` string, required: The plaintext secret. Shown exactly once — store it now; it can never be retrieved again.

## Other responses

- `401`: Not authenticated (no dashboard session).
- `403`: Insufficient permission (`apikeys:manage` required), or the workspace owner has not verified their phone number yet (`forbidden`) — the same anti-abuse prerequisite as creating a key in the dashboard, waived once the workspace has sent a real email or is on a paid plan.
- `422`: Validation error.

---

[API](https://skmtc.dev/unitpost/apis/unitpost-api.md) · [All operations](https://skmtc.dev/unitpost/apis/unitpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/unitpost/apis/unitpost-api/revisions/86ff7c890967?raw)