---
title: Create API Key
protocol: rest
method: POST
endpoint: /v1/projects/{projectId}/api-keys
description: "Create a new API key for a project."
---

# Create API Key

Create a new API key. The full key is returned **only once**, in this response — store it securely. Only a SHA-256 hash is persisted server-side.

<Endpoint method="POST" path="/v1/projects/{projectId}/api-keys" />

## Path Parameters

<ParamField path="projectId" type="string" required>
  The project ID.
</ParamField>

## Request Body

<ParamField body="name" type="string" required>
  A descriptive name (1–100 chars), e.g. `"CI deploy key"`.
</ParamField>

<ParamField body="scope" type="string" default="full">
  One of `full`, `build`, or `read`.
</ParamField>

<ParamField body="expiresInDays" type="integer">
  Optional expiry, 1–365 days. Omit for a non-expiring key.
</ParamField>

## Example

<CodeGroup>
```bash cURL
curl -X POST https://api.syntext.dev/v1/projects/prj_abc123/api-keys \
  -H "Authorization: Bearer stx_abc12345_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CI deploy key",
    "scope": "build",
    "expiresInDays": 90
  }'
```

```typescript SDK
const key = await client.apiKeys.create('prj_abc123', {
  name: 'CI deploy key',
  scope: 'build',
  expiresInDays: 90,
})
```
</CodeGroup>

### Response — 201 Created

```json
{
  "data": {
    "id": "key_789",
    "name": "CI deploy key",
    "key": "stx_a1b2c3d4_9XyZ...fullKeyShownOnlyOnce",
    "prefix": "stx_a1b2c3d4",
    "scope": "build",
    "expiresAt": "2026-10-01T10:00:00Z",
    "createdAt": "2026-07-03T10:00:00Z"
  }
}
```

<Warning>
The `key` field is only returned at creation (and on [rotation](/api-reference/api-keys/rotate)). If you lose it, rotate the key — it cannot be retrieved.
</Warning>

## Key Format

Keys look like `stx_{8-char prefix}_{secret}`. The prefix is safe to display and log; the full key is a secret.