Create an API key
Creates a new API key. The full key value is returned exactly once in this response — store it immediately. Subsequent reads return only the masked prefix and last four characters.
Idempotent — pass an Idempotency-Key header to make safely retryable. On a replay the original response is returned with Idempotent-Replayed: true. See the API conventions guide for the full state machine, TTL, and mismatch behaviour.
Authorizations
Project-scoped secret API key (sk_…). Pass in the Authorization: Bearer <key> header. Grants access to the project the key was issued for.
Body
Create a new project API key. The full value is returned exactly once — store it immediately; subsequent reads return a masked form.
Label for the new API key.
1"CI bot"
Defaults to secret when omitted.
public, secret Project role granted to the key. Defaults to support when omitted.
support, smtpproxy, editor, publisher, admin Response
The newly created API key, including its full value.
A project-scoped API key. Scope (public/secret) controls what endpoints it can call; role gates write access.
Numeric API key identifier.
12
Human-readable label for the API key.
"Production server"
public (pk_) keys are safe to embed in browser/SDK code on an explicit allowlist of endpoints. secret (sk_) keys grant full project-scoped access and must be kept server-side.
public, secret The caller’s role on this project.
support, smtpproxy, editor, publisher, admin The key value, prefixed with sk_ (secret) or pk_ (public). Returned in full only on creation; subsequent reads return a masked form.
"sk_01HXY7Z9K8M5J2N4P6Q8R0S1T2"
Optional description.
When true, the key is system-managed and cannot be archived from the API.