---
title: "Mint a new API key for the authenticated user"
method: POST
path: "/users/me/api-keys"
tags: ["API Keys"]
---

# Mint a new API key for the authenticated user

`POST /users/me/api-keys`

Mints an Overledger-issued API key. The response carries the raw key
ONCE in the `apiKey` field — it is unrecoverable afterwards. This route
accepts header-token auth only (a URL/header API key can never mint,
list, or revoke keys).

## Request body

- CreateApiKeyRequest
  - `label` string, required — Human-readable name for the key, e.g. "CI key".
  - `scopes` ApiKeyScope[] — Scopes to grant. Defaults to `["rpc"]` when omitted.
  - `expiresAt` string, date-time — Optional ISO-8601 expiry. Must be in the future; absent = no expiry.

## Response `201`

Key minted — `apiKey` shown once.

- MintedApiKey — The result of minting a key. The `apiKey` field carries the full raw key (`fk_<keyId>.<secret>`) and is returned ONCE — it is unrecoverable afterwards.
  - `apiKey` string, required — The full raw key — shown only once at creation.
  - `keyId` string, required
  - `label` string, required
  - `scopes` ApiKeyScope[], required
  - `createdAt` string, date-time, required
  - `lastUsedAt` string, date-time
  - `expiresAt` string, date-time

## Other responses

- `400` — Bad request
- `401` — Unauthorized — missing or invalid credentials

---

[API](https://skmtc.net/overledger/apis/overledger-server.md) · [All operations](https://skmtc.net/overledger/apis/overledger-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/overledger/overledger-server/revisions/dd31e0a52064/schema)