---
title: "Create API key"
method: POST
path: "/api-keys"
tags: ["api-keys"]
---

# Create API key

`POST /api-keys`

Full key returned only in this response. Community edition installs can create up to 2 API keys.

## Request body

- CreateAPIKeyRequest — Create API key request
  - `name` string, required — Human-readable name
  - `description` string — Purpose description
  - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
  - `workspaceAccess` WorkspaceAccess — Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role.
    - `all` boolean, required — Whether this identity can access all workspaces
    - `grants` WorkspaceGrant[], required — Workspace-specific grants used when all=false — unresolved $ref
  - `allowedSurfaces` string[], required — Interfaces where this API key may be accepted
  - `attributionClass` 'user_owned' | 'service_account', required — Whether this key is owned by a user or represents a service account
  - `ownerUserId` string — Owner user ID when attributionClass is user_owned
  - `serviceAccountName` string — Service-account display name when attributionClass is service_account

## Response `201`

Created

- CreateAPIKeyResponse — Create API key response
  - `apiKey` APIKey, required — API key information
    - `id` string, required — Unique identifier
    - `name` string, required — Human-readable name
    - `description` string — Purpose description
    - `role` 'admin' | 'manager' | 'developer' | 'operator' | 'viewer', required — User role determining access permissions. admin: full access including user management, manager: DAG CRUD and execution with audit log access, developer: DAG CRUD and execution, operator: DAG execution only, viewer: read-only
    - `workspaceAccess` WorkspaceAccess, required — Workspace access policy. all=true grants the top-level role in every workspace. all=false requires explicit workspace grants and a top-level viewer role.
      - `all` boolean, required — Whether this identity can access all workspaces
      - `grants` WorkspaceGrant[], required — Workspace-specific grants used when all=false — unresolved $ref
    - `allowedSurfaces` string[], required — Interfaces where this API key may be accepted
    - `attributionClass` 'user_owned' | 'service_account', required — Whether this key is owned by a user or represents a service account
    - `ownerUserId` string — Owner user ID when attributionClass is user_owned
    - `ownerUsername` string — Owner username when attributionClass is user_owned
    - `serviceAccountId` string — Service-account identifier when attributionClass is service_account
    - `serviceAccountName` string — Service-account display name when attributionClass is service_account
    - `migratedAsServiceAccount` boolean — True when a legacy key missing attributionClass was defaulted to service_account
    - `keyPrefix` string, required — First 8 characters for identification
    - `createdAt` string, date-time, required — Creation timestamp
    - `updatedAt` string, date-time, required — Last update timestamp
    - `createdBy` string, required — Creator user ID
    - `lastUsedAt` string, date-time, nullable — Last authentication timestamp
  - `key` string, required — Full key secret, only returned once

## Other responses

- `400` — Invalid request
- `401` — Not authenticated
- `403` — Requires admin role or community API key limit reached
- `409` — Name already exists
- `default` — Error

---

[API](https://skmtc.net/dagucloud/apis/dagu.md) · [All operations](https://skmtc.net/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/93cc41f2018a/schema)