> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbutter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API Key

Create a new API key for programmatic access to the Butter AI API. API keys are scoped to both the creating user and the current organization.

<Warning>
  The raw API key is only shown once in the response. Store it securely as it cannot be retrieved later.
</Warning>

### Headers

<ParamField header="Authorization" type="string" required>
  Bearer token from Cognito authentication (JWT).
</ParamField>

<ParamField header="X-Organization-Id" type="string" required>
  The organization ID.
</ParamField>

<ParamField header="Content-Type" type="string" required>
  Must be `application/json`.
</ParamField>

### Permissions

* Only `admin` and `agent_manager` roles can create API keys.
* You cannot create a key with a higher role than your own.

### Request Body

<ParamField body="name" type="string" required>
  A human-readable name for the API key (1-100 characters).
</ParamField>

<ParamField body="role" type="string" required>
  The role assigned to this API key. Must be one of: `admin`, `agent_manager`, `user`.
</ParamField>

<ParamField body="expires_at" type="string">
  Optional ISO 8601 UTC datetime when the key should expire. If not provided, the key never expires.
</ParamField>

### Response

<ResponseField name="raw_key" type="string">
  The full API key - shown once only. Store this securely.
</ResponseField>

<ResponseField name="key" type="object">
  The API key metadata.

  <Expandable title="properties">
    <ResponseField name="key_id" type="string">
      Unique key identifier.
    </ResponseField>

    <ResponseField name="name" type="string">
      The name of the API key.
    </ResponseField>

    <ResponseField name="role" type="string">
      The role assigned to this key.
    </ResponseField>

    <ResponseField name="prefix" type="string">
      The first 12 characters of the key (for identification).
    </ResponseField>

    <ResponseField name="client_id" type="string">
      The organization ID this key belongs to.
    </ResponseField>

    <ResponseField name="user_id" type="string">
      The user ID who created this key.
    </ResponseField>

    <ResponseField name="status" type="string">
      Current status (`active` or `revoked`).
    </ResponseField>

    <ResponseField name="created_at" type="string">
      ISO 8601 timestamp of creation.
    </ResponseField>

    <ResponseField name="last_used_at" type="string">
      ISO 8601 timestamp of last usage (null if never used).
    </ResponseField>

    <ResponseField name="expires_at" type="string">
      ISO 8601 timestamp of expiration (null if never expires).
    </ResponseField>
  </Expandable>
</ResponseField>

<RequestExample>
  ```json Request theme={null}
  {
    "name": "Production API Key",
    "role": "agent_manager",
    "expires_at": "2025-12-31T23:59:59Z"
  }
  ```
</RequestExample>

<ResponseExample>
  ```json Response theme={null}
  {
    "raw_key": "bk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "key": {
      "key_id": "apikey_a1b2c3d4e5f6",
      "name": "Production API Key",
      "role": "agent_manager",
      "prefix": "bk_live_xxxx",
      "client_id": "org_abc123",
      "user_id": "user_def456",
      "status": "active",
      "created_at": "2024-01-15T10:30:00Z",
      "last_used_at": null,
      "expires_at": "2025-12-31T23:59:59Z"
    }
  }
  ```
</ResponseExample>

### Error Responses

<Accordion title="403 Forbidden">
  Returned when the caller does not have permission to create API keys or is trying to create a key with a higher role than their own.

  ```json theme={null}
  {
    "detail": "Only admins and agent managers can create API keys"
  }
  ```
</Accordion>

<Accordion title="400 Bad Request">
  Returned when the role is invalid.

  ```json theme={null}
  {
    "detail": "role must be one of: admin, agent_manager, user"
  }
  ```
</Accordion>