---
title: "Create a key."
method: POST
path: "/tyk/keys"
tags: ["Keys"]
---

# Create a key.

`POST /tyk/keys`

Tyk will generate the access token based on the OrgID specified in the API Definition and a random UUID. This ensures that keys can be owned by different API Owners should segmentation be needed at an organisational level.
 <br/><br/>
  API keys without access_rights data will be written to all APIs on the system (this also means that they will be created across all SessionHandlers and StorageHandlers, it is recommended to always embed access_rights data in a key to ensure that only targeted APIs and their back-ends are written to.

## Query parameters

- `hashed` boolean

## Request body

- SessionState
  - `access_rights` object, nullable
  - `alias` string
  - `allowance` number, double
  - `apply_policies` string[], nullable
  - `apply_policy_id` string — deprecated use apply_policies going forward instead to send a list of policies ids
  - `basic_auth_data` BasicAuthData
    - `hash_type` string
    - `password` string
  - `certificate` string
  - `data_expires` integer
  - `date_created` string, date-time
  - `enable_detail_recording` boolean — deprecated use enable_detailed_recording going forward instead
  - `enable_detailed_recording` boolean
  - `enable_http_signature_validation` boolean
  - `expires` integer
  - `hmac_enabled` boolean
  - `hmac_string` string
  - `id_extractor_deadline` integer
  - `is_inactive` boolean
  - `jwt_data` JWTData
    - `secret` string
  - `last_check` integer
  - `last_updated` string
  - `max_query_depth` integer
  - `meta_data` object, nullable
  - `monitor` Monitor
    - `trigger_limits` number[], nullable
  - `oauth_client_id` string
  - `oauth_keys` object, nullable
  - `org_id` string
  - `per` number, double
  - `post_expiry_action` 'retain' | 'delete' — Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
  - `post_expiry_grace_period` integer — Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
  - `quota_max` integer
  - `quota_remaining` integer
  - `quota_renewal_rate` integer
  - `quota_renews` integer
  - `rate` number, double
  - `rsa_certificate_id` string
  - `session_lifetime` integer
  - `smoothing` RateLimitSmoothing, nullable
    - `delay` integer
    - `enabled` boolean
    - `step` integer
    - `threshold` integer
    - `trigger` number
  - `tags` string[], nullable
  - `throttle_interval` number, double
  - `throttle_retry_limit` integer

## Response `200`

New key added.

- ApiModifyKeySuccess
  - `action` string
  - `key` string
  - `key_hash` string
  - `status` string

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `500` — Internal server error.

---

[API](https://skmtc.net/tyktechnologies/apis/tyk-gateway-api.md) · [All operations](https://skmtc.net/tyktechnologies/apis/tyk-gateway-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tyktechnologies/tyk-gateway-api/versions/4ae998d5545e/schema)