---
title: "Create API Key"
method: POST
path: "/api_keys"
tags: ["API Keys"]
---

# Create API Key

`POST /api_keys`

Create a new org-level API key. Only org admins can create API keys.

## Request body

- ApiKeyCreateRequest — Request model for creating an API key.
  - `description` string, nullable — Optional description.
  - `name` string, required — Human-readable name for the API key.
  - `scopes` ApiKeyScope[], required — List of resource scopes. At least one scope is required.
    - `resource_id` string, required — ID of the resource.
    - `resource_type` string, required — Type of resource (namespace, project, agent).
    - `role` 'discoverer' | 'viewer' | 'editor' | 'admin' | 'owner' | 'member' | 'executor', required — Role that can be assigned to an API key for a scoped resource.
  - `sharing_group_ids` string[], required — IDs of groups that receive default admin grants on key-created resources.

## Response `201`

Successful Response

- ApiKeyCreateResponse — Response model for API key creation. Includes the full API key (shown only once).
  - `api_key` ApiKeyResponse, required — Response model for API key (excludes sensitive data).
    - `created_at` string, date-time, nullable — When the key was created.
    - `created_by` string, required — member_id of the creator.
    - `description` string, nullable — Optional description.
    - `id` string, required — The unique identifier of the API key.
    - `key_prefix` string, required — Display prefix (e.g., 'sk_tu_abc...').
    - `last_used_at` string, date-time, nullable — When the key was last used.
    - `name` string, required — Human-readable name for the API key.
    - `org_id` string, required — WorkOS organization ID.
    - `revoked_at` string, date-time, nullable — When the key was revoked (soft delete).
    - `scopes` ApiKeyScope[] — List of resource scopes for this API key.
      - `resource_id` string, required — ID of the resource.
      - `resource_type` string, required — Type of resource (namespace, project, agent).
      - `role` 'discoverer' | 'viewer' | 'editor' | 'admin' | 'owner' | 'member' | 'executor', required — Role that can be assigned to an API key for a scoped resource.
    - `sharing_group_ids` string[] — Groups that receive default admin grants on resources created by this key.
  - `key` string, required — The full API key. Store securely - it will NOT be shown again.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/terminaluse/apis/sb0-api.md) · [All operations](https://skmtc.net/terminaluse/apis/sb0-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/terminaluse/sb0-api/revisions/f24a474dc415/schema)