---
title: "Create API key"
method: POST
path: "/api-keys"
---

# Create API key

`POST /api-keys`

## Request

- Base URL: `https://app.yoping.me/api/v1`
- URL: `https://app.yoping.me/api/v1/api-keys`
- Auth: API key in cookie `yp_session`

Mints a new MCP API key. The raw token (prefixed `ypk_`) is returned once, at creation only. At most 10 keys per account (422 `plan_limit` beyond that).

## Request body

- CreateApiKeyRequest
  - `name` string, required
  - `write` boolean: Also grant the 'mcp:write' scope, which admits the key to the MCP write tools such as create_monitor. Off by default.

## Response `201`

Key created; `token` is the raw key, shown only in this response.

- object: Uniform success envelope: the payload is always under `data`.
  - `data` ApiKeyWithToken, required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: First 12 characters of the raw key ("ypk_" plus 8), for display.
    - `scopes` string[], required: Scopes the key carries. Always includes 'mcp'; 'mcp:write' additionally admits it to the MCP write tools.
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable, required
    - `revoked_at` string, date-time, nullable, required
    - `token` string, required: The raw API key ("ypk_"-prefixed). Returned only once, at creation.

## Other responses

- `400`: Invalid input (code `validation_failed`): malformed JSON, a missing or out-of-range field, bad pagination parameters, or a rejected token.
- `401`: Not authenticated (code `unauthorized`): missing, invalid, or expired session; invalid login credentials; or a Bearer token, which this surface rejects.
- `403`: Forbidden. Code `forbidden` for a cross-origin (CSRF) request blocked by origin validation or for API-key management attempted without a browser session; `account_suspended` when a suspended account attempts a mutation; `account_deleted` when an account in its deletion grace window calls a non-exempt route.
- `422`: A plan or account cap was hit (code `plan_limit`): monitor cap, distinct-target-host cap, or API-key cap.
- `429`: Too many requests (code `rate_limited`). A global per-IP budget of 300 requests/minute (burst 60) applies to every endpoint; login, signup, and test alerts have tighter dedicated limits.

---

[API](https://skmtc.dev/yoping/apis/yopingme-api.md) · [All operations](https://skmtc.dev/yoping/apis/yopingme-api/llms.txt) · [OpenAPI document](https://skmtc.dev/yoping/apis/yopingme-api/revisions/76d8deb40173?raw)