---
title: "Share an API key"
method: POST
path: "/api-keys/{id}/shares"
tags: ["Account"]
---

# Share an API key

`POST /api-keys/{id}/shares`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/api-keys/{id}/shares`
- Auth: HTTP bearer

Shares the key with people by email, so they can reveal and use it. Only
the key's owner (or a manager of the owning team) can share. Emails
with no varg account are returned in `not_found` and nothing is shared
with them. A key can be shared with at most 50 people. Rate limited
per user. Requires an app session (Supabase JWT), not an API key.

## Path parameters

- `id` string, uuid, required

## Request body

- ApiKeyShareRequest
  - `emails` string[], required

## Response `200`

Updated shares, plus emails that could not be shared

- object
  - `owner` ApiKeyPerson
    - `user_id` string, uuid
    - `email` string, nullable
    - `display_name` string, nullable
    - `avatar_url` string, nullable
  - `shares` ApiKeyShare[]
    - `user_id` string, uuid
    - `email` string, nullable
    - `display_name` string, nullable
    - `avatar_url` string, nullable
    - `shared_at` string, date-time
  - `not_found` string[], required: Emails with no varg account

## Other responses

- `401`: Missing or invalid API key / JWT
- `403`: Only app sessions can manage API keys (API keys and connected applications are rejected)
- `404`: Unknown API key, or you have no access to it
- `422`: Invalid body, or the key is already shared with the maximum number of people (`share_limit_reached`)
- `429`: Too many share requests

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/api-keys/:id/shares/post.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)