---
title: "Issue an API key"
method: POST
path: "/api-keys"
tags: ["API Keys"]
---

# Issue an API key

`POST /api-keys`

Issues an exact-scope credential for an existing workspace member or a new named agent. Requires api_keys:write, a live admin/owner membership, and an Idempotency-Key. The encrypted secret response is replayable for 24 hours; after that it cannot be recovered. Credential-management scopes cannot be delegated.

## Headers

- `Idempotency-Key` string, required — Idempotency key.

## Request body

- ApiKeyIssueBody — Issues an exact-scope credential for a new named agent or an existing workspace member. api_keys administration scopes cannot be delegated.
  - `name` string, nullable, required — Optional operator-facing key label.
  - `scopes` string[], required — Exact non-administrative scopes to grant.
  - `subject` union, required — Identity the new credential will act as.
    - object — Create a new named agent identity.
      - `display_name` string, required — Unique agent display name.
      - `kind` 'new_agent', required — Subject kind.
      - `role_name` string, nullable, required — Optional role label.
    - object — Bind the credential to an existing workspace member.
      - `kind` 'workspace_member', required — Subject kind.
      - `workspace_membership_id` string, required — Existing workspace membership identifier.

## Response `201`

Issued API key.

- ApiKeySecretResponse — API key response that reveals the new secret exactly once.
  - `data` object, required — New credential data.
    - `key` ApiKey, required — Reveal-safe API key metadata. The secret is only returned by issue and rotate responses.
      - `id` string, required — Stable API key identifier.
      - `key_prefix` string, required — Non-secret prefix for operator recognition.
      - `name` string, nullable, required — Optional operator-facing key label.
      - `scopes` string[], required — Exact scopes granted to the key.
      - `status` 'active' | 'disabled' | 'revoked', required — Credential lifecycle status.
      - `subject` ApiKeySubject, required — Workspace identity the credential acts as.
        - `display_name` string, nullable, required — Current subject display name.
        - `principal_type` 'agent' | 'user', required — Subject principal type.
        - `workspace_membership_id` string, required — Subject workspace membership identifier.
    - `secret` string, required — New API key secret. Store it immediately; it cannot be read later.

## Other responses

- `400` — Bad request.
- `401` — Missing or invalid API key.
- `403` — Forbidden.
- `404` — Not found.
- `409` — Conflict.
- `429` — Rate limit or quota exceeded.
- `500` — Internal server error.

---

[API](https://skmtc.net/ando/apis/ando-public-api.md) · [All operations](https://skmtc.net/ando/apis/ando-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ando/ando-public-api/revisions/0a94056fba48/schema)