POST /api-keys

Create api key

Bearer API key or staff session application/json operation createApiKey

Request

Content type: application/json · required

Field	Type	Required	Description
`name`	string	Yes	—
`env`	string	No	one of `live`, `sandbox`
`scopes`	array of string	No	Only `admin` changes authorization today. It grants the management plane (credential and team administration). Every key, with or without `admin`, has company-wide data-plane access; other labels are reserved and are not per-service boundaries.
`scheme`	string	No	ed25519 registers a client public key (no secret returned) one of `secret`, `ed25519`
`public_key`	string	No	32-byte hex Ed25519 public key (scheme ed25519 only)

curl -X POST "$MONICHEK_API/api-keys" \
  -H "Authorization: Bearer $MONICHEK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Ada Okafor",
  "env": "live",
  "scopes": [
    "string"
  ],
  "scheme": "secret",
  "public_key": "string"
}'

const res = await fetch(`${MONICHEK_API}/api-keys`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${MONICHEK_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "Ada Okafor",
    "env": "live",
    "scopes": [
      "string"
    ],
    "scheme": "secret",
    "public_key": "string"
  }),
});

const data = await res.json();

import os
import requests

res = requests.post(
    f"{os.environ['MONICHEK_API']}/api-keys",
    headers={"Authorization": f"Bearer {os.environ['MONICHEK_API_KEY']}"},
    json={
      "name": "Ada Okafor",
      "env": "live",
      "scopes": [
        "string"
      ],
      "scheme": "secret",
      "public_key": "string"
    },
)
print(res.json())

$ch = curl_init(getenv('MONICHEK_API') . '/api-keys');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('MONICHEK_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'name' => 'Ada Okafor',
        'env' => 'live',
        'scopes' => [
            'string',
        ],
        'scheme' => 'secret',
        'public_key' => 'string',
    ]),
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Responses

201 Created key (secret shown once) application/json

{
  "id": "key_01M3R...",
  "prefix": "wpk_test_01M3R...",
  "secret": "<shown once>",
  "warning": "shown once — store securely"
}

Response fields

Field	Type	Required	Description
`id`	string	No	—
`prefix`	string	No	—
`secret`	string	No	shown once
`scopes`	array of string	No	`admin` grants the management plane; all keys have company-wide data-plane access. Other scopes are reserved metadata.

Error responses

Status	Meaning	Body
401	Unauthorized	RFC 9457 problem
422	Unprocessable Entity	RFC 9457 problem

Errors use the RFC 9457 problem format with a stable code.