---
title: "Create API key"
method: POST
path: "/api_keys"
tags: ["ApiKeys"]
---

# Create API key

`POST /api_keys`

This endpoint lets you create a new API key.

For more details on how API keys work, and how to handle them securely, see the [Security and API Key Usage](/guides/api/resources/settings/security_and_api_key_usage) guide.

## Request body

- ApiKeyBody — Request body schema for creating or updating an API key
  - `label` string — Name given to recognize the Api key
  - `description` string — Description of the API key
  - `expiration_date` string — Must be at least the day after today. If you want it to expire today you must revoke it. You can set it to null.
  - `ip_whitelist` string[] — List of IP or CIDR network notations to which API Key calls are restricted. Empty list means no restriction.
  - `has_restricted_permissions` boolean — Whether or not the API key has customized permissions. If false, it has the same permissions as the user who created the key. ⚠️ **Required if the `permissions` parameter is provided.** ⚠️
  - `permissions` string[] — List of permission names to assign to the API Key. ⚠️ **Required if the `has_restricted_permissions` parameter is provided.** ⚠️

## Response `201`

Created

- ApiKey — Base API Key object with common properties
  - `id` integer
  - `label` string — Name given to recognize the Api key
  - `description` string — Description of the API key
  - `user_id` string — User id
  - `user_name` string — User first name and last name concatenated. Can be null if it's your org integration api key.
  - `user_role` 'PROVIDER' | 'ORG_ADMIN' | 'ORG_MANAGER' | 'GROUP_MANAGER' | 'BUSINESS_MANAGER' | 'PUBLISHER' — User role in the application
  - `user_type` 'bot' | 'user' — Whether the API key belongs to a bot user (created automatically for integrations) or a regular human user.
  - `disabled` boolean — Is true if someone revoked the key.
  - `expiration_date` string — Must be at least the day after today. If you want it to expire today you must revoke it. You can set it to null.
  - `last_used_at` string
  - `created_by` string — User id
  - `created_by_name` string — First name and last name concatenated of the user that created the key
  - `created_at` string
  - `revoked_by` string — User id
  - `revoked_by_name` string — First name and last name concatenated of the user that revoked the key
  - `revoked_at` string
  - `ip_whitelist` string[] — List of IP or CIDR network notations to which API Key calls are restricted. Empty list means no restriction.
  - `has_restricted_permissions` boolean — Whether or not the API key has customized permissions. If false, it has the same permissions as the user who created the key.
  - `permissions` string[] — List of permission names linked to the API Key.

## Other responses

- `400` — Your request is incorrect
- `401` — You are not authenticated
- `403` — You are not allowed to perform this action

---

[API](https://skmtc.net/partoo/apis/partoo-rest-api.md) · [All operations](https://skmtc.net/partoo/apis/partoo-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/partoo/partoo-rest-api/revisions/3652d8b1a8b3/schema)