---
title: "Create an API key"
method: POST
path: "/v1/keys"
tags: ["keys"]
---

# Create an API key

`POST /v1/keys`

Scope: `keys` (always opt-in; a default-minted key cannot mint further keys). Returns the raw key ONCE. Subsequent reads only return the prefix.

An account may hold up to 200 active keys by default; beyond that, creation fails with KEY_LIMIT_REACHED. Revoke unused keys rather than reusing one across services. A key-store outage returns 503 DB_UNAVAILABLE with Retry-After rather than a bare 500.

## Request body

- CreateAPIKeyRequest
  - `name` string, required
  - `scopes` string[] — Omit or send [] for the server default shown here: 20 of the 23 scopes, covering every ordinary product surface (including terminal:exec, files:write, snapshots:write, machines:write, schedules and triggers) so you do not have to discover a scope list before your first call. Exactly THREE scopes are always opt-in, because each is a privilege escalation rather than a product tier and must be requested explicitly: - `keys` — mints AND revokes further Coasty API keys (POST /v1/keys, GET /v1/keys, DELETE /v1/keys/{key_id}). - `browser:execute` — runs arbitrary JavaScript in the machine's browser session. - `connection:read` — returns plaintext connection secrets such as SSH keys. Requesting a narrower set than the default is supported and recommended for keys you hand to a single service.

## Response `200`

Key created.

- APIKeyResponse
  - `key` string, required — The raw API key. Returned ONCE only.
  - `key_id` string, required
  - `name` string, required
  - `tier` 'free' | 'starter' | 'professional' | 'enterprise', required
  - `scopes` string[], required
  - `created_at` string, date-time, required

## Other responses

- `400` — Invalid request body or parameters.
- `401` — Missing, invalid, or revoked API key. Pass `X-API-Key: sk-coasty-live-...` (or test).
- `403` — API key lacks the required scope or tier-feature is unavailable on the caller's plan.
- `404` — Resource not found in this key's namespace.
- `409` — The resource state conflicts with this operation.
- `413` — The request body exceeds the endpoint limit.
- `422` — The JSON shape is valid but one or more values violate the endpoint contract.
- `429` — Rate or concurrency limit exceeded.
- `500` — Unexpected server error. Retry with exponential backoff.
- `502` — An upstream dependency returned an invalid response.
- `503` — A required service is temporarily unavailable.
- `504` — An upstream dependency timed out.

---

[API](https://skmtc.net/coasty/apis/coasty-public-api.md) · [All operations](https://skmtc.net/coasty/apis/coasty-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coasty/coasty-public-api/revisions/f50d93b0d8a1/schema)