---
title: "GET /private/create_api_key"
method: GET
path: "/private/create_api_key"
tags: ["Account Management", "Private"]
---

# GET /private/create_api_key

`GET /private/create_api_key`

Creates a new API key with the specified scope and permissions. API keys are used for programmatic access to the Deribit API and can be restricted to specific operations and IP addresses.

The response includes both the API key ID and the secret key. Store the secret securely as it will not be displayed again. You can view the API key details (without the secret) using the `list_api_keys` method.

**Note:** The new API key cannot be granted higher scopes than the API key used for authentication. Attempting to assign a scope that exceeds the authenticating key's permissions will result in an error.

**[TFA required](https://docs.deribit.com/articles/security-keys)**

**📖 Related Articles:** 
- [Creating new API key on Deribit](https://docs.deribit.com/articles/creating-api-key)
- [Access Scope](https://docs.deribit.com/articles/access-scope)

**Scope:** `account:read_write`

[Try in API console](https://test.deribit.com/api_console?method=%2Fprivate%2Fcreate_api_key)

## Query parameters

- `max_scope` string[], required — Describes maximal access for tokens generated with given key. If scope is not provided, its value is set as none. **📖 Related Article:** [Access Scope](https://docs.deribit.com/articles/access-scope)
- `name` string
- `public_key` string
- `enabled_features` string[]

## Response `200`

Success response

- PrivateApiKeyResponse
  - `jsonrpc` '2.0', required — The JSON-RPC version (2.0)
  - `id` integer — The id that was sent in the request
  - `result` ApiKey, required
    - `id` integer, required — Key identifier
    - `timestamp` integer, required — The timestamp (milliseconds since the Unix epoch)
    - `client_id` string, required — Client identifier used for authentication
    - `client_secret` string, required — Client secret or MD5 fingerprint of public key used for authentication
    - `public_key` string — PEM encoded public key (Ed25519/RSA) used for asymmetric signatures (optional)
    - `max_scope` string[], required — Describes maximal access for tokens generated with given key. If scope is not provided, its value is set as none. **📖 Related Article:** [Access Scope](https://docs.deribit.com/articles/access-scope)
    - `enabled` boolean — Informs whether api key is enabled and can be used for authentication
    - `default` boolean, required — Informs whether this api key is default (field is deprecated and will be removed in the future)
    - `name` string — Api key name that can be displayed in transaction log
    - `enabled_features` string[] — List of enabled advanced on-key features.<br><br><b>Available options:</b><br>- <code>restricted_block_trades</code>: Limit the block_trade read the scope of the API key to block trades that have been made using this specific API key<br>- <code>block_trade_approval</code>: Block trades created using this API key require additional user approval. Methods that use <code>block_rfq</code> scope are not affected by Block Trade approval feature
    - `ip_whitelist` unknown[] — List of IP addresses whitelisted for a selected key
      - unknown

---

[API](https://skmtc.net/deribit/apis/deribit-api.md) · [All operations](https://skmtc.net/deribit/apis/deribit-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deribit/deribit-api/revisions/c254e4a8a23c/schema)