---
title: "Create Api Key"
method: POST
path: "/users/me/api-keys"
tags: ["api-keys"]
---

# Create Api Key

`POST /users/me/api-keys`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/users/me/api-keys`
- Auth: none declared

Mint a key for the caller. Returns the secret **once**.

``company_id`` set → company-scoped (the caller must be a member; admins may pick
any existing company); ``None`` → full-access (the caller's full account access).

``expires_at`` is optional and defaults to never. A key past its expiry is refused
with a message that says so — distinct from a revoked one, because the remedies
differ: mint a new one, versus somebody deliberately killed this one.

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Request body

- ApiKeyCreate: ``POST /users/me/api-keys`` body — a label + optional company scope. ``company_id`` set → the key is confined to that company (the caller must be a member); ``None`` (default) → a full-access key acting with the caller's full account access.
  - `name` string, required
  - `company_id` string, nullable
  - `expires_at` string, date-time, nullable

## Response `201`

Successful Response

- ApiKeyCreated: ``POST`` response — the metadata plus the one-time raw ``key``. ``key`` (``prefix.secret``) is shown exactly once; it is unrecoverable after this response. Distinct from :class:`ApiKeyResponse` so the secret is never conflated with the read shape.
  - `api_key` ApiKeyOut, required: Serialized key metadata — never the secret or its hash. ``company_id``/``company_name`` are null for a full-access key **and for an onboarding key**, which is why ``purpose`` exists: without it the two render identically in the management list, and one of them can do everything the owner can.
    - `id` string, required
    - `name` string, required
    - `prefix` string, required
    - `purpose` string, required
    - `company_id` string, nullable
    - `company_name` string, nullable
    - `last_used_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `expires_at` string, date-time, nullable
    - `created_at` string, date-time, required
    - `is_active` boolean, required
  - `key` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)