---
title: "Create an API key"
method: POST
path: "/v1/{organization}/organization/api_key/"
tags: ["Organization"]
---

# Create an API key

`POST /v1/{organization}/organization/api_key/`

Create a new API key for the given organization. This API key authorizes the organization to retrieve a per-user access token for users in this organization which allows the users to access most of Amigo's API endpoints.
This API key is valid for the duration specified in the request. There's no way to extend the duration of an API key. The API key is not retrievable after issuance, so please keep it in a secure location.

Each organization has a maximum limit of 20 API keys.

#### Permissions
This endpoint requires the following permissions:
* `Organization:CreateAPIKey`.
* This endpoint requires the authenticated user to have more privileges than the role associated with the API key.

## Path parameters

- `organization` string, required

## Headers

- `x-mongo-cluster-name` string, nullable — The Mongo cluster name to perform this request in. This is usually not needed unless the organization does not exist yet in the Amigo organization infra config database.
- `Sec-WebSocket-Protocol` string[]

## Request body

- SrcAppEndpointsOrganizationCreateApiKeyRequest
  - `name` string, required
  - `duration` string, duration, required — The valid duration of the API key. Should be supplied in the [ISO8601 format](https://en.wikipedia.org/wiki/ISO_8601#Durations). Must be between 1 to 90 days.
  - `role_name` string — The name of the role associated with the key. When using this API key to authenticate, it can only authenticate for users with roles that are less permissive than this role.

## Response `201`

Succeeded.

- SrcAppEndpointsOrganizationCreateApiKeyResponse
  - `api_key_id` string, required — An identifier for this API key. You must present this along with the API key to authenticate.
  - `api_key` string, required — The API key. This is only visible once and is not retrievable later. Please store safely.
  - `expires_at` string, date-time, required — Expiration time of the API key in UTC.

## Other responses

- `400` — The organization has reached the maximum API key limit.
- `401` — Invalid authorization credentials.
- `403` — Missing required permissions.
- `404` — The specified organization or role does not exist.
- `409` — A related operation is in progress.
- `422` — Invalid request path parameter or request body failed validation.
- `429` — The user has exceeded the rate limit of 5 requests per minute for this endpoint.
- `503` — The service is going through temporary maintenance.

---

[API](https://skmtc.net/amigo/apis/amigo-api.md) · [All operations](https://skmtc.net/amigo/apis/amigo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/amigo/amigo-api/revisions/f0f28319e448/schema)