---
title: "Create an API key"
description: "Secret shown once."
canonical_url: "https://twominutebilling.com/help/developers/api-reference/organization/create-an-api-key"
---
# Create an API key

> Secret shown once.

<api-operation method="POST" path="/v1/api_keys">
<template v-slot:docs="">

## Headers

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        Idempotency-Key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Safely retry writes — repeats return the original response. If a write FAILED after it had already taken effect, that failure is what repeats: the key is spent, and a new attempt needs a new key.
    </td>
  </tr>
</tbody>
</table>

## Body

The request body is optional.

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        livemode
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      'all' is reserved for the dashboard credential and is no longer mintable over the API — this route only ever creates kind=api keys, and an integration talks to one partition at a time. Requesting it returns 400. One of <code>
        test
      </code>
      
      , <code>
        live
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        name
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      What the key is for, shown wherever keys are listed. Optional; blank or omitted stores no name. Not unique — two keys may share a name while one is rotated out.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        scope
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      'read' permits GETs and the handful of non-mutating POSTs; anything else mints a write key. One of <code>
        read
      </code>
      
      , <code>
        write
      </code>
      
      . Defaults to <code>
        "write"
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        expires_at
      </code>
    </td>
    
    <td>
      <code>
        string · ISO-8601
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      When the key stops working (ISO 8601, must be in the future). Omit or send null for a key that never expires. After this time the key is refused exactly like a revoked key.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        permissions
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Access per resource, for example <code>
        {"invoices": "read", "customers": "write"}
      </code>
      
      . <code>
        read
      </code>
      
       allows the resource's read operations; <code>
        write
      </code>
      
       allows all of them. A resource not named is refused. Null or omitted: the key works by its scope.
    </td>
  </tr>
</tbody>
</table>

## Response

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The object type.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        id
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The api key's id (key_…).
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        name
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The key's name.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        prefix
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The first characters of the key, so you can recognize it. The full key is shown only once, when you create it.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        livemode
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <code>
        live
      </code>
      
       for a live key, <code>
        test
      </code>
      
       for a test key. One of <code>
        test
      </code>
      
      , <code>
        live
      </code>
      
      , <code>
        all
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        scope
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      What the key can do: <code>
        read
      </code>
      
       or <code>
        write
      </code>
      
      . One of <code>
        read
      </code>
      
      , <code>
        write
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        secret
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      Returned once at creation only.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        last_used_at
      </code>
    </td>
    
    <td>
      <code>
        string · ISO-8601
      </code>
    </td>
    
    <td>
      When the key was last used (ISO-8601 UTC), or null.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        created_at
      </code>
    </td>
    
    <td>
      <code>
        string · ISO-8601
      </code>
    </td>
    
    <td>
      When the api key was created (ISO-8601 UTC).
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        revoked_at
      </code>
    </td>
    
    <td>
      <code>
        string · ISO-8601
      </code>
    </td>
    
    <td>
      When the key was revoked (ISO-8601 UTC), or null.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        expires_at
      </code>
    </td>
    
    <td>
      <code>
        string · ISO-8601
      </code>
    </td>
    
    <td>
      When the key stops working (ISO-8601 UTC), or null if it never expires.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        permissions
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      The key's permission map. Null: the key works by its scope.
    </td>
  </tr>
</tbody>
</table>

## Status codes

<table>
<thead>
  <tr>
    <th>
      Status
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        201
      </code>
    </td>
    
    <td>
      Created
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        400
      </code>
    </td>
    
    <td>
      Invalid body
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        403
      </code>
    </td>
    
    <td>
      The caller cannot grant this access (<code>
        code: permission_escalation
      </code>
      
      ): a member may grant only permissions their role has, and a key only what it holds itself
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        409
      </code>
    </td>
    
    <td>
      Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload.
    </td>
  </tr>
</tbody>
</table>
</template>

<template v-slot:request="">

```bash [Request]
curl -X POST "$TMBILLING_URL/v1/api_keys" \
  -H "Authorization: Bearer $TMBILLING_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Example"
  }'
```

</template>

<template v-slot:response="">
<code-group>

```json [201 Created]
{
  "object": "api_key",
  "id": "key_XXXXXXXXXXXX01",
  "name": "Production billing sync",
  "prefix": "sk_test_AbCd",
  "livemode": "test",
  "scope": "read",
  "secret": "whsec_XXXXXXXXXXXX01",
  "last_used_at": "2026-03-14T09:30:00Z",
  "created_at": "2026-03-14T09:30:00Z",
  "revoked_at": "2026-03-14T09:30:00Z",
  "expires_at": "2026-04-14T09:30:00Z",
  "permissions": {}
}
```

```json [400 Bad Request]
{
  "error": {
    "type": "invalid_request_error",
    "message": "Invalid body"
  }
}
```

```json [403 Forbidden]
{
  "error": {
    "type": "permission_error",
    "message": "The caller cannot grant this access (code: permission_escalation): a member may grant only permissions their role has, and a key only what it holds itself"
  }
}
```

```json [409 Conflict]
{
  "error": {
    "type": "idempotency_error",
    "message": "Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload."
  }
}
```

</code-group>
</template>
</api-operation>


## Sitemap

See the full [sitemap](https://twominutebilling.com/sitemap.md) for all pages.