> ## Documentation Index
> Fetch the complete documentation index at: https://docs.twinbay.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Mints a key for the active organization. It acts with the caller's role, read from their membership on every request, so it can never outrank them. The response is the only time the token is readable.



## OpenAPI

````yaml https://api.twinbay.ai/openapi.json post /organizations/current/api-keys
openapi: 3.1.0
info:
  title: Twinbay
  description: Backend API
  version: 0.1.0
servers:
  - url: https://api.twinbay.ai
    description: Production
security: []
tags:
  - name: healthchecks
    description: Healthcheck endpoints
  - name: users
    description: >-
      The current user. Sign-up and sign-in happen in WorkOS AuthKit, which
      issues the access tokens this API accepts.
  - name: organizations
    description: >-
      Organizations the caller belongs to. Every authenticated request acts
      inside exactly one organization — the one its access token names — so
      these routes address it as `current`.
  - name: api-keys
    description: >-
      Long-lived credentials for callers that cannot hold an AuthKit session —
      agents, SDKs, CI. A key is accepted wherever an access token is, and acts
      with the role its creator holds when the request arrives.
  - name: sandboxes
    description: >-
      Create and edit isolated provider sandboxes. Each sandbox contains
      behavioural twins from the `twins` package.
  - name: twins
    description: Browse the digital twins available for new sandboxes.
paths:
  /organizations/current/api-keys:
    post:
      tags:
        - api-keys
      summary: Create an API key
      description: >-
        Mints a key for the active organization. It acts with the caller's role,
        read from their membership on every request, so it can never outrank
        them. The response is the only time the token is readable.
      operationId: create_api_key
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
      responses:
        '201':
          description: The new key, including its token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedApiKeyResponse'
        '401':
          description: The credential is missing, malformed, expired, or not trusted
        '403':
          description: >-
            The credential does not act inside an organization, or it is an API
            key
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - Access token: []
        - Organization API key: []
components:
  schemas:
    CreateApiKeyRequest:
      properties:
        name:
          type: string
          maxLength: 100
          minLength: 1
          title: Name
          description: What this key is for, in the operator's words
        expires_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Expires At
          description: >-
            When the key stops working on its own. Omitted or null for a key
            that only stops when it is revoked.
      additionalProperties: false
      type: object
      required:
        - name
      title: CreateApiKeyRequest
    CreatedApiKeyResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        name:
          type: string
          title: Name
        created_at:
          type: string
          format: date-time
          title: Created At
        expires_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Expires At
          description: When the key stops working, or null when it never does
        created_by:
          $ref: '#/components/schemas/UserResponse'
          description: >-
            The member whose role the key acts with. Demoting or removing them
            changes what the key can do.
        token:
          type: string
          title: Token
          description: >-
            The credential itself, to send in the `X-API-Key` header. Only the
            digest is stored, so this is the only time it is readable.
      type: object
      required:
        - id
        - name
        - created_at
        - expires_at
        - created_by
        - token
      title: CreatedApiKeyResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    UserResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        email:
          type: string
          format: email
          title: Email
        first_name:
          type: string
          title: First Name
        last_name:
          type: string
          title: Last Name
      type: object
      required:
        - id
        - email
        - first_name
        - last_name
      title: UserResponse
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    Access token:
      type: http
      description: Access token issued by WorkOS AuthKit.
      scheme: bearer
    Organization API key:
      type: apiKey
      description: >-
        An organization API key, as minted by POST
        /organizations/current/api-keys.
      in: header
      name: X-API-Key

````