---
title: "Create an API key (returns the plaintext once)"
method: POST
path: "/v1/orgs/{orgId}/api-keys/create"
tags: ["API Keys"]
---

# Create an API key (returns the plaintext once)

`POST /v1/orgs/{orgId}/api-keys/create`

## Path parameters

- `orgId` string, required

## Request body

- CreateApiKeyRequest
  - `expiresInSeconds` integer — Optional server-side expiry, in seconds from now. When set (and > 0) the key stops authenticating after this many seconds, capping the leak window regardless of any client-side cleanup. Omitted or <= 0 means the key never expires (the default).
  - `name` string, required
  - `scopes` string[] — Supported values: clusters:read, clusters:write, vms:read, vms:write, inference.

## Response `200`

Created

- CreateApiKeyResult
  - `createdAt` string, required
  - `id` string, required
  - `key` string, required — Plaintext key — shown once
  - `keyPrefix` string, required
  - `name` string, required
  - `organizationId` string, required — The organization this key is bound to. Every API key belongs to exactly one organization; keep this id alongside the key so callers can build org-scoped request paths without a separate lookup (GET /v1/whoami returns the same id for an existing key).
  - `scopes` string[], required

## Other responses

- `400` — The request is invalid
- `401` — Missing or invalid API key
- `403` — API key lacks the required scope

---

[API](https://skmtc.net/openrelay/apis/openrelay-api.md) · [All operations](https://skmtc.net/openrelay/apis/openrelay-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openrelay/openrelay-api/versions/4c42fd61ed41/schema)