> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kintra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Creates the credential a Gateway API integration signs its requests with. `name` is required and has to be unique among your active keys; `label` and `expires_at` are optional, where `expires_at` takes an ISO date or date-time in the future and a date-only value is read as end of day. Omit it for a key that does not expire. The response `data` carries the key record plus `secret`, and `secret` is returned on this response only: it cannot be read back from any other route, so store it before you move on. Send `key_id` as `X-Tenant-Key` on gateway requests and sign each one with `secret`. Returns 403 when your account may not manage keys for this tenant, and 404 when the tenant is not found.



## OpenAPI

````yaml /openapi/kintra-app.json post /tenant/{tenantId}/api-keys
openapi: 3.0.0
info:
  description: >-
    Tenant portal API for the Kintra loyalty platform. Requests are
    authenticated with an Auth0 bearer token and address a tenant by id in the
    path.
  title: Kintra Portal API
  version: 1.0.0
servers:
  - description: Production environment
    url: https://api.kintra.io/api/v1
security: []
paths:
  /tenant/{tenantId}/api-keys:
    post:
      tags:
        - API keys
      summary: Create an API key
      description: >-
        Creates the credential a Gateway API integration signs its requests
        with. `name` is required and has to be unique among your active keys;
        `label` and `expires_at` are optional, where `expires_at` takes an ISO
        date or date-time in the future and a date-only value is read as end of
        day. Omit it for a key that does not expire. The response `data` carries
        the key record plus `secret`, and `secret` is returned on this response
        only: it cannot be read back from any other route, so store it before
        you move on. Send `key_id` as `X-Tenant-Key` on gateway requests and
        sign each one with `secret`. Returns 403 when your account may not
        manage keys for this tenant, and 404 when the tenant is not found.
      operationId: TenantCreateApiKey
      parameters:
        - in: path
          name: tenantId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ICreateTenantApiKeyBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/ApiResponse_ICreateTenantApiKeyResponseDto_
          description: Ok
        '201':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/ApiResponse_ICreateTenantApiKeyResponseDto_
          description: ''
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponse_null_'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponse_null_'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponse_null_'
          description: Tenant not found
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponse_null_'
          description: Internal server error
      security:
        - auth0_jwt: []
components:
  schemas:
    ICreateTenantApiKeyBody:
      additionalProperties: false
      properties:
        expires_at:
          description: >-
            Optional expiry. ISO date (`YYYY-MM-DD`) or date-time; a date-only
            value

            is treated as end-of-day. Must be in the future. Omit for a key that
            never expires.
          nullable: true
          type: string
        label:
          nullable: true
          type: string
        name:
          description: Required, unique among the tenant's active keys.
          type: string
      required:
        - name
      type: object
    ApiResponse_ICreateTenantApiKeyResponseDto_:
      additionalProperties: false
      properties:
        data:
          $ref: '#/components/schemas/ICreateTenantApiKeyResponseDto'
        errors:
          items:
            properties:
              message:
                type: string
              path:
                type: string
            required:
              - path
              - message
            type: object
          type: array
        message:
          type: string
        success:
          type: boolean
      required:
        - success
      type: object
    ApiResponse_null_:
      additionalProperties: false
      properties:
        data:
          enum:
            - null
          nullable: true
          type: number
        errors:
          items:
            properties:
              message:
                type: string
              path:
                type: string
            required:
              - path
              - message
            type: object
          type: array
        message:
          type: string
        success:
          type: boolean
      required:
        - success
      type: object
    ICreateTenantApiKeyResponseDto:
      additionalProperties: false
      properties:
        created_at:
          format: date-time
          type: string
        expires_at:
          format: date-time
          nullable: true
          type: string
        id:
          type: string
        key_id:
          type: string
        label:
          nullable: true
          type: string
        last_used_at:
          format: date-time
          nullable: true
          type: string
        name:
          type: string
        secret:
          description: 'Shown only once; use as HMAC secret with `X-Tenant-Key: key_id`.'
          type: string
        secret_prefix:
          type: string
        secret_suffix:
          type: string
        status:
          anyOf:
            - $ref: '#/components/schemas/TenantApiKeyStatus'
            - type: string
        updated_at:
          format: date-time
          type: string
      required:
        - id
        - key_id
        - name
        - secret_prefix
        - secret_suffix
        - status
        - secret
      type: object
    TenantApiKeyStatus:
      enum:
        - active
        - expired
        - revoked
      type: string
  securitySchemes:
    auth0_jwt:
      bearerFormat: JWT
      description: Auth0 access token
      scheme: bearer
      type: http

````