---
title: "Create API key for service account"
method: POST
path: "/service-accounts/{idOrName}/api-keys"
---

# Create API key for service account

`POST /service-accounts/{idOrName}/api-keys`

Mint a new API key bound to a service account. The full identifier is only returned on this response. Team admin only.

## Path parameters

- `idOrName` string, required — The ID or name of the service account this key authenticates as.

## Request body

- CreateServiceAccountAPIKeyParams
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `expires_at` string, date-time — When the API key expires.
  - `name` string, required — Human-readable name for the API key.
  - `scopes` string — Space-separated scopes for the key. Defaults to the SA's role scopes when omitted.

## Response `201`

Created

- CreateServiceAccountAPIKeyResponse
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `api_key` APIKey, required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time
    - `identifier` string, required
    - `last_used_at` string, date-time, nullable, required
    - `name` string, required
    - `owner` APIKeyOwner
      - `name` string, required — The owner's name: a user's full name (or email) or a service account's name.
      - `type` 'user' | 'service_account', required — The kind of principal this API key authenticates as.
    - `scopes` string

## Other responses

- `default` — Error

---

[API](https://skmtc.net/tower/apis/tower-api.md) · [All operations](https://skmtc.net/tower/apis/tower-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tower/tower-api/revisions/0e42b0fb26d9/schema)