---
title: "Create an API key"
method: POST
path: "/api-keys"
tags: ["Account"]
---

# Create an API key

`POST /api-keys`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/api-keys`
- Auth: HTTP bearer

Creates a new API key. The plaintext key is returned **once** in the
`api_key` field — store it securely. Requires an app session (JWT).

## Request body

- object
  - `name` string
  - `type` 'personal' | 'service'
  - `revealable` boolean: Keep an encrypted copy so the key can be shown again (`POST /api-keys/{id}/reveal`). Default `false` = shown once.

## Response `201`

Key created

- object
  - `api_key` string: The plaintext key — shown only once
  - `key` ApiKey
    - `id` string, uuid, required
    - `key_preview` string, required
    - `name` string, required
    - `type` 'personal' | 'service', required: `personal` acts for the creating user; `service` is a shared credential with no human behind it
    - `on_behalf_of_user_id` string, uuid, nullable, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `last_active_at` string, date-time, nullable, required
    - `revealable` boolean, required: Whether the full key can be shown again (only keys created with `revealable` set to `true`)
    - `role` 'owner' | 'shared', required
    - `owner` object, nullable, required: Whose key this is, when `role` is `shared`
      - `user_id` string
      - `email` string, nullable
      - `display_name` string, nullable
      - `avatar_url` string, nullable
    - `shared_count` integer, required

## Other responses

- `400`: Request failed validation (`invalid_request`)
- `401`: Missing or invalid API key / JWT
- `403`: Only app sessions can create API keys
- `422`: Account key limit reached (`api_key_limit_reached`)
- `429`: Too many keys created (5 per hour per account) (`rate_limited`)

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/api-keys/post.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)