<!-- https://cutedyno.com/docs/api/create-api-key -->

# Create an API key

`POST https://api.cutedyno.com/v1/api-keys`

Mints a key, optionally scoped to specific profiles. The secret is returned once and cannot be retrieved later.


Required permission: `connections:write`

Required permission: `connections:write`

Accepts an `Idempotency-Key` header.

## Body

- `name` (string, required) — Label shown in the dashboard.
- `scope` (object) — Defaults to full.
- `profileIds` (string[]) — Restrict the key to these profiles. Omit for access to every profile in the account.
- `expiresIn` (integer) — Days until the key expires. Omit for no expiry.
- `allowedAccountIds` (string[]) — Restrict the key to these connected accounts.
- `maxPostsPerDay` (integer) — Cap posts created per UTC day with this key.
- `requireApproval` (boolean) — Force posts from this key through approval.

## Request

```bash
curl -X POST "https://api.cutedyno.com/v1/api-keys" \
  -H "Authorization: Bearer $CUTEDYNO_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Acme Corp",
  "profileIds": [
    "string"
  ],
  "expiresIn": 0,
  "allowedAccountIds": [
    "string"
  ],
  "maxPostsPerDay": 0,
  "requireApproval": false
}'
```

```typescript
import { CuteDyno } from '@cutedyno/node';

const cutedyno = new CuteDyno();

const result = await cutedyno.apiKeys.create({
  name: "Acme Corp",
  profileIds: [
    "string"
  ],
  expiresIn: 0,
  allowedAccountIds: [
    "string"
  ],
  maxPostsPerDay: 0,
  requireApproval: false
});
console.log(result);
```

```python
import os
import requests

url = "https://api.cutedyno.com/v1/api-keys"
headers = {"Authorization": f"Bearer {os.environ['CUTEDYNO_API_KEY']}"}

payload = {
    "name": "Acme Corp",
    "profileIds": [
        "string"
    ],
    "expiresIn": 0,
    "allowedAccountIds": [
        "string"
    ],
    "maxPostsPerDay": 0,
    "requireApproval": False
}

response = requests.post(url, json=payload, headers=headers)
response.raise_for_status()
print(response.json())
```

## Response 201

- `key` (ApiKey, required)
- `secret` (string, required) — The only time the full key is returned.
- `message` (string, required)

```json
{
  "key": {
    "id": "a1b2c3d4-0000-4000-8000-000000000000",
    "name": "Acme Corp",
    "keyPrefix": "string",
    "scope": "full",
    "profileIds": [
      "string"
    ],
    "expiresAt": "string",
    "createdAt": "string"
  },
  "secret": "whsec_2f8a...",
  "message": "Shipping today."
}
```

## Errors

- `invalid_request` (400) — The request body or query string failed validation. The message names the offending field.
- `invalid_api_key` (401) — The key does not exist, was revoked, or is malformed. Keys start with cdyn_live_.
- `insufficient_permission` (403) — The key is missing the scope this endpoint needs, for example posts:write on a readonly key.
- `profile_not_accessible` (403) — The requested profile is outside this key’s scope, or belongs to another account.
- `rate_limit_exceeded` (429) — Too many requests for this key. Honour the Retry-After header before retrying.
- `internal_error` (500) — Something failed on our side. Retry with the same Idempotency-Key; report the requestId if it persists.