# Create API Key

> Create a key. The response holds the only copy of it.

Requires an API key with the `admin` scope.

N e Not available while acting as a client workspace. API keys are never created, listed or revoked over MCP.

A new key can only hold scopes the calling key holds, and only `read`, `write` and `admin`. Leave `scopes` out to copy the calling key's scopes. A key with only `read` cannot create keys at all. The call writes an `audit.api_key.created` entry with the key id, name, prefix and scopes, never the key.

## Body Parameters

<ParamField body="name" type="string" required>
  A name unique in the workspace, up to 100 characters.
</ParamField>

<ParamField body="scopes" type="string[]">
  Any non-empty subset of `read`, `write`, `admin` that the calling key also has.
</ParamField>

## Response

Returns the key in `data` with a `key` field holding the full secret. It is shown once and cannot be retrieved again.

<RequestExample>
```bash cURL
curl -X POST "https://api.foxreach.io/api/v1/api-keys" \
  -H "X-API-Key: otr_your_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI deploy", "scopes": ["read", "write"]}'
```

```python Python SDK
from foxreach import FoxReach

client = FoxReach(api_key="otr_your_key")
created = client.api_keys.create("CI deploy", scopes=["read", "write"])
```

```typescript TypeScript SDK
import { FoxReach } from "foxreach";

const client = new FoxReach({ apiKey: "otr_your_key" });
const created = await client.apiKeys.create({ name: "CI deploy", scopes: ["read", "write"] });
```

</RequestExample>

<ResponseExample>
```json
{ "data": { "id": "cak_abc123", "name": "CI deploy", "prefix": "otr_ab12", "scopes": ["read", "write"], "lastUsedAt": null, "expiresAt": null, "createdAt": "2026-11-04T09:30:00+00:00" , "key": "otr_..." } }
```
</ResponseExample>

## Errors

| Status | Description |
|--------|-------------|
| `401` | Missing, invalid, revoked or expired API key |
| `403` | The key lacks the `admin` or `write` scope, or its creator lacks the required role |
| `403` | Asked for a scope the calling key does not hold (`scope_escalation`) |
| `403` | Called while acting as a client workspace with `X-Workspace-Id` (`acting_as_forbidden`) |
| `409` | A key with that name already exists |
| `422` | Unknown scope, empty scopes, or a bad name |

## Rate Limit

- **120 requests per minute, shared by every `write` call in your workspace.** Fixed 60-second window.
- Every response includes `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (unix epoch seconds) and `X-RateLimit-Bucket` (`write`).
- A `429` response includes a `Retry-After` header (seconds until the bucket resets).

For client-side patterns, see [Rate Limiting](/rate-limiting).