> ## Documentation Index
> Fetch the complete documentation index at: https://gproxy.leenhawk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /admin/api/api-keys



## OpenAPI

````yaml /generated/openapi.json post /admin/api/api-keys
openapi: 3.1.0
info:
  description: >-
    Forwarding, management, portal and OAuth APIs generated from Rust types.
    Input and output schemas preserve their respective Serde contracts.
    Streaming events and WebSocket messages are documented alongside HTTP
    payloads.
  title: GPROXY HTTP API
  version: 4.2.1
servers: []
security:
  - bearer: []
  - anthropicKey: []
  - googleKey: []
  - queryKey: []
paths:
  /admin/api/api-keys:
    post:
      tags:
        - Management
      summary: POST /admin/api/api-keys
      parameters:
        - description: Administrative scope selected by the caller.
          in: header
          name: x-gproxy-admin-scope
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Input_ApiKeyWrite'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_ApiKeyCreated'
          description: Success
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_Envelope'
          description: Gateway error
      security:
        - consoleSession: []
        - bearer: []
        - anthropicKey: []
        - googleKey: []
components:
  schemas:
    Input_ApiKeyWrite:
      properties:
        budget:
          anyOf:
            - $ref: '#/components/schemas/Input_ApiKeyBudgetWrite'
            - type: 'null'
          default: null
          description: Optional initial cost budget, committed atomically with the key.
        enabled:
          default: null
          type:
            - boolean
            - 'null'
        expiresAtMs:
          default: null
          format: int64
          type:
            - integer
            - 'null'
        id:
          default: null
          type:
            - string
            - 'null'
        management:
          default: null
          description: |-
            Let the key manage: `/admin/api`, and the portal's key and password
            operations. Off by default.
          type:
            - boolean
            - 'null'
        name:
          type: string
        organizationId:
          default: null
          description: >-
            The binding that decides the budget chain, the permission subject
            and

            the credential-visibility boundary at once. It is set here, once,
            and

            never taken from a request header.
          type:
            - string
            - 'null'
        retainSecret:
          default: null
          description: >-
            Keep a sealed copy of the key text so it can be revealed later.
            False

            by default: a key the instance cannot reproduce is a key a database

            leak does not hand over.
          type:
            - boolean
            - 'null'
        teamId:
          default: null
          type:
            - string
            - 'null'
        userId:
          type: string
      required:
        - userId
        - name
      type: object
    Output_ApiKeyCreated:
      description: >-
        A minted or rotated key. `token` is the only time the plaintext exists
        in

        a response; a caller that loses it rotates the key, it is not
        recoverable

        unless the row was created with `retainSecret`.
      properties:
        enabled:
          type: boolean
        expiresAtMs:
          format: int64
          type:
            - integer
            - 'null'
        hasSecret:
          description: |-
            Whether the instance retained a sealed copy of the key text, i.e.
            whether `reveal` can answer. The bytes themselves have no field.
          type: boolean
        id:
          type: string
        kind:
          description: >-
            `user` or `oauth`. An `oauth` key is a grant's internal key and is
            not

            a bearer credential; it is listed so an operator can see it, never

            created or revealed through this family.
          type: string
        management:
          description: Whether the key may manage; see `api_keys.management`.
          type: boolean
        name:
          type: string
        organizationId:
          type:
            - string
            - 'null'
        prefix:
          description: >-
            The first eight characters of the key body, for recognising a key in
            a

            list. Not a secret and not enough of one to be useful.
          type: string
        teamId:
          type:
            - string
            - 'null'
        token:
          type: string
        userId:
          type: string
      required:
        - id
        - userId
        - name
        - prefix
        - kind
        - organizationId
        - teamId
        - expiresAtMs
        - enabled
        - management
        - hasSecret
        - token
      type: object
    Output_Envelope:
      properties:
        error:
          $ref: '#/components/schemas/Output_EnvelopeBody'
      required:
        - error
      type: object
    Input_ApiKeyBudgetWrite:
      description: >-
        A key's initial cost budget. Ownership and metric are assigned by the
        server.
      properties:
        anchorAtMs:
          default: null
          format: int64
          type:
            - integer
            - 'null'
        limitValue:
          type: string
        modelPattern:
          default: null
          type:
            - string
            - 'null'
        period:
          default: null
          type:
            - string
            - 'null'
        periodSeconds:
          default: null
          format: int64
          type:
            - integer
            - 'null'
        windowKey:
          default: null
          type:
            - string
            - 'null'
      required:
        - limitValue
      type: object
    Output_EnvelopeBody:
      properties:
        code:
          type: string
        message:
          type: string
      required:
        - code
        - message
      type: object
  securitySchemes:
    bearer:
      scheme: bearer
      type: http
    anthropicKey:
      in: header
      name: x-api-key
      type: apiKey
    googleKey:
      in: header
      name: x-goog-api-key
      type: apiKey
    queryKey:
      in: query
      name: key
      type: apiKey
    consoleSession:
      in: cookie
      name: gproxy_session
      type: apiKey

````

## Related topics

- [POST /admin/api/api-keys/batch](https://gproxy.leenhawk.com/api-reference/management/post-adminapiapi-keysbatch.md)
- [POST /admin/api/api-keys/{id}/rotate](https://gproxy.leenhawk.com/api-reference/management/post-adminapiapi-keys-rotate.md)
- [Users and API keys](https://gproxy.leenhawk.com/guides/users-and-keys.md)
- [GET /admin/api/api-keys](https://gproxy.leenhawk.com/api-reference/management/get-adminapiapi-keys.md)
- [DELETE /admin/api/api-keys/{id}](https://gproxy.leenhawk.com/api-reference/management/delete-adminapiapi-keys.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.