---
title: "POST /api/keys"
method: POST
path: "/api/keys"
tags: ["api", "api_keys"]
---

# POST /api/keys

`POST /api/keys`

Create an API Key

## Request body

- POSTApiKeysCreateAnApiKey
  - `name` string, required — An internal name to identify the API key.
  - `orgId` string — The organization ID for which to create the API key.
  - `expiresAt` string, date-time — Optional expiry time (strictly future, at most one year); omit for keys that do not auto-expire.
  - `permissions` string[] — Seller API keys only: initial permissions.
  - `fullSellerAccess` boolean — Seller API keys only: when true, grants full seller access.

## Response `201`

Created

- APIKeyResource
  - `_id` string, required — The ID of the API key.
  - `active` boolean — Whether the API key can be used to authenticate against the API.
  - `name` string, required — An internal name to identify the API key.
  - `sellerId` string — The ID of the seller that owns the API key.
  - `orgId` string — The ID of the organisation that owns the API key.
  - `key` string, required — The secret key to be used to authenticate against the API.
  - `createdBy` object — The entity that created the API key.
    - `type` 'USER' | 'APP' | 'API_KEY' | 'SYSTEM', required — The type of the entity
    - `id` string, required — The ID of the entity
  - `createdAt` string, date-time, required — An ISO Timestamp indicating when the API Key was created.
  - `updatedAt` string, date-time, required — An ISO Timestamp indicating when the API Key was last updated.
  - `expiresAt` string, date-time, nullable — Optional ISO instant after which the key no longer authenticates; omit or null for no automatic expiry.
  - `version` integer — The version of the API key.
  - `fullSellerAccess` boolean — Seller keys only: when true, grants full seller access (seller-admin equivalent).
  - `permissions` string[] — Explicit permissions

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

## Changes

- **2026-09-05** `0c9cb42c536a` — 5 info
  - added the new optional request property `fullSellerAccess`
  - added the new optional request property `permissions`
  - added the optional property `fullSellerAccess` to the response with the `201` status
  - added the optional property `permissions` to the response with the `201` status
  - …1 more

[Change history](https://skmtc.dev/vivenu/apis/vivenu-api/changes/api/keys/post.md)

---

[API](https://skmtc.dev/vivenu/apis/vivenu-api.md) · [All operations](https://skmtc.dev/vivenu/apis/vivenu-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vivenu/apis/vivenu-api/revisions/ff78046ac535?raw)