---
title: "Create an API key (admin, interactive session only)"
method: POST
path: "/api-keys"
tags: ["API keys"]
---

# Create an API key (admin, interactive session only)

`POST /api-keys`

Mints a new portal API key with scope `read` or `write`. The `api_key` secret (`lac_sk_...`) is returned once and never again — store it securely. Requires an interactive admin session; API-key bearers receive 403.

## Request body

- object
  - `name` string, required — Human-readable key name (max 120 characters).
  - `scope` 'read' | 'write', required — `read` keys are refused on all mutating methods; `write` keys act as the operator role.

## Response `201`

Key created. The secret is returned only in this response.

- object
  - `api_key` string — The bearer secret, `lac_sk_...`. Shown only once.
  - `record` ApiKey — Portal API key metadata (never contains the secret).
    - `id` string
    - `name` string
    - `scope` 'read' | 'write'
    - `created_by` string
    - `created_at` string
    - `last_used_at` string, nullable
    - `revoked_at` string, nullable

## Other responses

- `401` — Missing or invalid bearer token.
- `403` — Insufficient scope or role — e.g. a read-scoped key on a mutating method, or an API key on an admin/approver-only endpoint.

---

[API](https://skmtc.net/lastaccountingcompany/apis/lac-customer-api.md) · [All operations](https://skmtc.net/lastaccountingcompany/apis/lac-customer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lastaccountingcompany/lac-customer-api/versions/52e277b4f031/schema)