---
title: "Create API key"
method: POST
path: "/tenants/{tenant_id}/api_keys"
tags: ["API Keys"]
---

# Create API key

`POST /tenants/{tenant_id}/api_keys`

Creates a tenant-scoped API key. Provide `role_id` to reuse an existing role, or `permissions` to mint a dedicated single-purpose role automatically. The returned `token` is shown ONCE - store it immediately, it cannot be retrieved again.

## Path parameters

- `tenant_id` integer, required

## Request body

- CreateApiKey
  - `allowed_ips` string[], nullable
  - `division_id` integer
  - `expiry_at` string, date-time, required — Expiration timestamp (RFC 3339 UTC).
  - `name` string, required
  - `permissions` RolePermissions
    - `division` string[], nullable
    - `divisions` object, nullable
    - `environment` string[], nullable
    - `tenant` string[], nullable
  - `role_id` integer
  - `validate_ip` boolean, required

## Response `201`

API key created. `token` returned once and never again

- ApiKeyToken
  - `id` integer, required
  - `token` string, required

## Other responses

- `400` — Invalid name, expiry beyond 365 days, or both role_id and permissions provided
- `403` — Insufficient permissions on the tenant
- `409` — Name already used in this tenant or limit reached

---

[API](https://skmtc.net/laserdata/apis/laserdata-cloud-core-api.md) · [All operations](https://skmtc.net/laserdata/apis/laserdata-cloud-core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/laserdata/laserdata-cloud-core-api/revisions/db81a447bba9/schema)