---
title: "Create an API credential"
method: POST
path: "/api/v1/user/api-credentials"
tags: ["User", "API Credentials"]
---

# Create an API credential

`POST /api/v1/user/api-credentials`

Creates a credential once and returns the full token on the original response or an identical Idempotency-Key retry within 24 hours. Requires session cookie, X-CSRF-Token, a durable users.sqlite idempotency schema and configured credential/idempotency key material. List/get never expose the token.

## Headers

- `X-CSRF-Token` string, required
- `Idempotency-Key` string, required

## Request body

- ApiCredentialCreateRequest
  - `name` string
  - `scopes` string[], required
  - `expires_at` string, date-time, nullable — Default 90 days; maximum 366 days.

## Response `201`

Credential created, or its encrypted one-time response replayed for the same key and payload

- ApiCredentialOneTimeResponse
  - `ok` true, required
  - `credential` ApiCredential, required
    - `id` integer, required
    - `name` string, required
    - `prefix` string, required — Non-secret identification prefix.
    - `last4` string, required
    - `hint` string, required
    - `scopes` string[], required
    - `status` 'active' | 'expired' | 'revoked', required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `last_used_at` string, date-time, nullable
    - `rotated_from_id` integer, nullable
    - `legacy_migrated` boolean
  - `token` string, required — Visible only in the original create/rotate response and identical Idempotency-Key replays during the 24-hour recovery window; never recoverable through list/get.
  - `token_visible_once` true, required
  - `replaced_credential_id` integer
  - `idempotency_replayed` boolean, required
  - `idempotency_expires_at` integer, required — Unix timestamp for the encrypted replay window.

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `403` — Invalid CSRF token
- `409` — Active credential limit, Idempotency-Key payload conflict, or expired replay window
- `429` — Rate limit exceeded
- `503` — Credential pepper, idempotency encryption keyring/schema, or account service unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)