---
title: "Create a new management key"
method: POST
path: "/v2/management-keys"
tags: ["Management keys"]
---

# Create a new management key

`POST /v2/management-keys`

Mints a new opaque management key (`sk-orq-<key_id>-<secret>`) in the workspace. The raw secret is returned ONCE in the response and is never retrievable afterwards. The stored record retains only `token_prefix` and a SHA-256 `token_hash`.

## Request body

- CreateManagementKeyRequest
  - `name` string, required — Human-readable name. Required.
  - `permission_mode` 'MANAGEMENT_PERMISSION_MODE_UNSPECIFIED' | 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY'
  - `access` object — Per-domain access map. Required when `permission_mode` = `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. See `ManagementKey.access` for the catalog of valid keys (Domain.id) and AccessLevel string values, or fetch the live catalog via the capability catalog endpoint.
  - `expires_at` string, date-time — Optional expiration. When set, the authenticate hot-path rejects the key once `expires_at` is in the past. Unset means the key never expires.

## Response `200`

OK

- CreateManagementKeyResponse
  - `management_key` ManagementKey, required — ManagementKey is the canonical record stored in MongoDB `auth.managementKeys`. It is the source of truth for permissions, expiration, and revocation. Management keys are always workspace-scoped — there is no project_scope field, and they have no per-user owner (every management key is workspace-owned; `created_by_id` records who created it).
    - `management_key_id` string, required — Canonical key identifier (ULID). Embedded in opaque tokens as `sk-orq-<id>-<secret>`.
    - `name` string, required — Human-readable name shown in the dashboard.
    - `permission_mode` 'MANAGEMENT_PERMISSION_MODE_UNSPECIFIED' | 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY', required
    - `access` object — Per-domain access map. Only populated when `permission_mode` is `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. Valid keys are the Domain.id values in the management capability catalog — see libs/catalog/orq/managementkeys/v1/catalog.textpb for the canonical list.
    - `token_prefix` string, required — Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe to expose.
    - `status` 'MANAGEMENT_KEY_STATUS_UNSPECIFIED' | 'MANAGEMENT_KEY_STATUS_ACTIVE' | 'MANAGEMENT_KEY_STATUS_DISABLED' | 'MANAGEMENT_KEY_STATUS_REVOKED', required
    - `created_by_id` string — Audit: user who created the key.
    - `updated_by_id` string — Audit: user who last updated the key.
    - `created_at` string, date-time, required — Time the key was created.
    - `updated_at` string, date-time, required — Time the key was last updated.
    - `last_used_at` string, date-time — Last authenticated use.
    - `expires_at` string, date-time — Optional expiration. The authenticate hot-path rejects keys whose `expires_at` is in the past. Unset means the key never expires.
  - `token` string, required — Raw bearer token in the form `sk-orq-<management_key_id>-<secret>`. Returned ONCE; the API never exposes this value again.

---

[API](https://skmtc.net/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.net/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/orq-ai/orq-ai-api/revisions/2cd7e7f7bcb4/schema)