Create API Key
Creates an API key for a company or app. The response is the only place the full secret_key is returned — store it immediately. Requires a user session; API keys cannot manage API keys.
Authorizations
A company API key, company scoped JWT, app API key, or user OAuth token. You must prepend your key/token with the word 'Bearer', which will look like Bearer ***************************
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-07-20"
Body
A human-readable name for the API key, such as 'Production API Key'.
The permissions policy for the API key: explicit permission statements, or a system role to inherit from. Statements without a resources array default to the owning company (company keys) or every key-addressable resource (app keys).
The company (biz_) or app (app_) tag to create the API key for.
The type of resource that will own this API key.
account, app When the API key should stop working, as an ISO 8601 timestamp. Omit (or pass null on update) for a key that never expires.
IPv4/IPv6 CIDR ranges allowed to use this key, for example ["203.0.113.0/24"]. Empty or null allows any IP.
Response
api key created
When the API key was created, as an ISO 8601 timestamp.
When the API key stops working, as an ISO 8601 timestamp. null means it never expires.
API key ID, prefixed apik_.
IPv4/IPv6 CIDR ranges allowed to use this key. null or empty means requests are accepted from any IP.
Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated.
Human-readable name identifying the API key, or null when none was set.
Masked version of the secret key, so the key can be recognized without revealing the full secret.
System role the key inherits its permissions from, or null when it uses an explicit permissions policy. Only account API keys can use a system role.
owner, admin, moderator, sales_manager, advertiser, null "owner"
When the API key was last updated, as an ISO 8601 timestamp.
The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately.

