---
title: "Provision a checkout customer API key"
method: POST
path: "/v1/checkout/provision-api-key"
---

# Provision a checkout customer API key

`POST /v1/checkout/provision-api-key`

## Request

- Base URL: `https://api.uploadcheck.app`
- URL: `https://api.uploadcheck.app/v1/checkout/provision-api-key`
- Auth: HTTP bearer

Authenticated provisioning endpoint for checkout/webhook/account flows. It applies UploadCheck plan economics server-side and returns the raw apiKey only on the first successful provisioning call. Optional overage_cap_cents approves extra-minute spend after included deterministic minutes; zero or omitted blocks at included minutes. Stored workspace API keys with api_keys:write are pinned to their own workspace, owner, plan economics, and overage cap before checkout provisioning. Idempotent retries return the redacted key record without the bearer secret.

## Request body

- object
  - `plan_id` 'creator' | 'studio' | 'network', required
  - `owner_email` string, required
  - `workspace_id` string
  - `checkout_customer_id` string
  - `checkout_subscription_id` string
  - `overage_cap_cents` integer
  - `provisioning_id` string: Optional idempotency key. Defaults to checkout:<plan>:<subscription/customer/workspace>.

## Response `200`

Existing provisioning record returned without bearer secret.

## Other responses

- `201`: Provisioned API key; raw apiKey is shown once.
- `400`: Invalid plan or missing owner email
- `401`: Missing or invalid provisioning API key
- `403`: API key lacks api_keys:write scope

---

[API](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api.md) · [All operations](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api/revisions/d7c8a14caa30?raw)