---
title: "Create an API credential."
method: POST
path: "/companies/{companyId}/apiCredentials"
tags: ["API credentials - company level"]
---

# Create an API credential.

`POST /companies/{companyId}/apiCredentials`

Creates an [API credential](https://docs.adyen.com/development-resources/api-credentials) for the company account identified in the path. In the request, you can specify which merchant accounts the new API credential will have access to, as well as its roles and allowed origins.

The response includes several types of authentication details:
* [API key](https://docs.adyen.com/development-resources/api-authentication#api-key-authentication): used for API request authentication.
* [Client key](https://docs.adyen.com/development-resources/client-side-authentication#how-it-works): public key used for client-side authentication.
* [Username and password](https://docs.adyen.com/development-resources/api-authentication#using-basic-authentication): used for basic authentication.

> Make sure you store the API key securely in your system. You won't be able to retrieve it later.

If your API key is lost or compromised, you need to [generate a new API key](https://docs.adyen.com/api-explorer/#/ManagementService/v1/post/companies/{companyId}/apiCredentials/{apiCredentialId}/generateApiKey).

To make this request, your API credential must have the following [roles](https://docs.adyen.com/development-resources/api-credentials#api-permissions):
* Management API—API credentials read and write

## Path parameters

- `companyId` string, required

## Request body

- CreateCompanyApiCredentialRequest
  - `allowedOrigins` string[] — List of [allowed origins](https://docs.adyen.com/development-resources/client-side-authentication#allowed-origins) for the new API credential.
  - `associatedMerchantAccounts` string[] — List of merchant accounts that the API credential has access to.
  - `description` string — Description of the API credential.
  - `roles` string[] — List of [roles](https://docs.adyen.com/development-resources/api-credentials#roles-1) for the API credential. Only roles assigned to 'ws@Company.<CompanyName>' can be assigned to other API credentials.

## Response `200`

OK - the request has succeeded.

- CreateCompanyApiCredentialResponse
  - `_links` ApiCredentialLinks
    - `allowedOrigins` LinksElement
      - `href` string
    - `company` LinksElement
      - `href` string
    - `generateApiKey` LinksElement
      - `href` string
    - `generateClientKey` LinksElement
      - `href` string
    - `merchant` LinksElement
      - `href` string
    - `self` LinksElement, required
      - `href` string
  - `active` boolean, required — Indicates if the API credential is enabled. Must be set to **true** to use the credential in your integration.
  - `allowedIpAddresses` string[], required — List of IP addresses from which your client can make requests. If the list is empty, we allow requests from any IP. If the list is not empty and we get a request from an IP which is not on the list, you get a security error.
  - `allowedOrigins` AllowedOrigin[] — List containing the [allowed origins](https://docs.adyen.com/development-resources/client-side-authentication#allowed-origins) linked to the API credential.
    - `_links` Links
      - `self` LinksElement, required
        - `href` string
    - `domain` string, required — Domain of the allowed origin.
    - `id` string — Unique identifier of the allowed origin.
  - `apiKey` string, required — The API key for the API credential that was created.
  - `associatedMerchantAccounts` string[], required — List of merchant accounts that the API credential has access to.
  - `clientKey` string, required — Public key used for [client-side authentication](https://docs.adyen.com/development-resources/client-side-authentication). The client key is required for Drop-in and Components integrations.
  - `description` string — Description of the API credential.
  - `id` string, required — Unique identifier of the API credential.
  - `password` string, required — The password for the API credential that was created.
  - `roles` string[], required — List of [roles](https://docs.adyen.com/development-resources/api-credentials#roles-1) for the API credential.
  - `subjectDN` string — The subject DN of the certificate issued by Adyen.
  - `username` string, required — The name of the [API credential](https://docs.adyen.com/development-resources/api-credentials), for example **ws@Company.TestCompany**.

## Other responses

- `400` — Bad Request - a problem reading or understanding the request.
- `401` — Unauthorized - authentication required.
- `403` — Forbidden - insufficient permissions to process the request.
- `422` — Unprocessable Entity - a request validation error.
- `500` — Internal Server Error - the server could not process the request.

---

[API](https://skmtc.net/adyen/apis/management-api.md) · [All operations](https://skmtc.net/adyen/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adyen/management-api/revisions/1089ade06e17/schema)