---
title: "Create API key"
method: POST
path: "/api-keys"
tags: ["ApiKeys"]
---

# Create API key

`POST /api-keys`

Creates a new API key and its actor record. The role must not have broader permissions than the creating user's role (prevents privilege escalation). Response includes the raw key exactly once.

## Headers

- `Idempotency-Key` string, uuid

## Request body

- CreateApiKeyRequest
  - `name` string, required
  - `roleId` string, uuid, required
  - `expiresAt` number — Unix timestamp in milliseconds for key expiration

## Response `201`

Created — the raw key is included and cannot be retrieved again

- object
  - `data` ApiKeyWithRawKey, required — API key returned on creation, including the raw key shown only once
    - `id` string, uuid, required
    - `actorId` string, uuid, required
    - `name` string, required
    - `prefix` string, required — First 12 characters, safe to display (e.g. "sk_live_a1b2")
    - `createdBy` string, uuid, required — User ID of the creator
    - `deletedAt` number, nullable, required
    - `createdAt` number, required
    - `lastUsedAt` number, nullable, required
    - `expiresAt` number, nullable, required
    - `rawKey` string, required — The raw API key; returned only on creation and cannot be retrieved again
  - `transactionId` string, uuid, required

## Other responses

- `400` — Bad request or validation error
- `401` — Authentication required
- `403` — Insufficient permissions
- `409` — Conflict (duplicate resource, in-use resource, or undo conflict)
- `429` — Rate limit exceeded
- `500` — Internal server error

---

[API](https://skmtc.net/voltairlabs/apis/voltair-api.md) · [All operations](https://skmtc.net/voltairlabs/apis/voltair-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/voltairlabs/voltair-api/revisions/be08f4f706f5/schema)