---
title: "Create Project Key"
method: POST
path: "/project-keys"
tags: ["Project Keys"]
---

# Create Project Key

`POST /project-keys`

Create a Project Key with API credentials and optional Kafka access.

Returns a credential file (JSON) with plaintext secrets. This is a one-time delivery -
secrets are masked in all subsequent responses. Optionally creates a Kafka user with
SCRAM credentials, K8s proxy, and ACLs.

## Request body

- ProjectKeyCreateRequest — Request body for creating a Project Key.
  - `name` string, required — Human-readable name for this Project Key
  - `description` string, nullable — Optional description (HTML sanitized)
  - `role_ids` string[], nullable — Role IDs to assign. Mutually exclusive with permission_ids.
  - `permission_ids` string[], nullable — Permission IDs to assign directly. Mutually exclusive with role_ids.
  - `kafka_config` ProjectKeyKafkaConfig — Kafka user configuration for a Project Key.
    - `username` string, required — Kafka username (alphanumeric + hyphens, 3-24 chars)
    - `password` string, required — Kafka SASL password (12-128 chars)
    - `whitelist_ips` string, nullable — Comma-separated IP addresses or CIDR ranges
    - `kafka_acls` KafkaAclModel[] — Kafka ACL rules for topic/group access control
      - `topic_name` string, required
      - `operation` string, required
      - `resource_pattern_type` string, required
      - `resource` string
    - `is_create_schema_registry` boolean — Whether to create a Schema Registry proxy
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable — MCP tool whitelist. If set, overrides profile and block list.
  - `blocked_tools` string[], nullable — MCP tool blacklist. Removes tools even if profile allows them.
  - `agentic_enabled` boolean — When true, atomically seeds ``agentic_secret_blob`` on the new PK row from the credential file produced during creation. The PK is then immediately usable as the auth blob behind the Streamkap MCP. Requires API credentials (role_ids or permission_ids) - rejected with 400 on Kafka-only PKs since there is no API credential to seed. Audit-logged with action=enable. Post-creation toggling goes through POST /project-keys/{id}/enable-agentic or /disable-agentic.

## Response `201`

Successful Response

- ProjectKeyCredentialFile — The downloadable .json credential file returned at creation time.
  - `type` string
  - `project_key_id` string, required
  - `project` object, required
  - `api` ProjectKeyApiCredentials — API credential section of the credential file.
    - `client_id` string, required
    - `client_secret` string, required
    - `token_endpoint` string, required
    - `api_url` string, required
    - `roles` string[]
  - `kafka` ProjectKeyKafkaCredentials — Kafka credential section of the credential file.
    - `username` string, required
    - `password` string, required
    - `bootstrap_servers` string, required
    - `security_protocol` string
    - `sasl_mechanism` string
    - `schema_registry_url` string, nullable
  - `kafka_acls` object[]
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable
  - `blocked_tools` string[], nullable
  - `created_at` string, date-time, required
  - `created_by` string, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/streamkap/apis/streamkap-rest-api.md) · [All operations](https://skmtc.net/streamkap/apis/streamkap-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/streamkap/streamkap-rest-api/versions/8aea6143d003/schema)