> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookstream.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

Create a new API key for the authenticated user. The full key is returned only once.

` POST /auth/api-keys `

Create API key

Create a new API key for the authenticated user. The full key is returned only once.

## Servers

- ` https://hookstream.io/v1 ` — Production

## Authentication

The operation accepts these alternatives. Schemes within one alternative are required together.

### Alternative 1

- ` apiKey `: ` apiKey `

  - Credential: ` X-API-Key ` in ` header `

  - API key (format: hs_live_<64hex> or hs_test_<64hex>)

### Alternative 2

- ` cookieAuth `: ` apiKey `

  - Credential: ` better-auth.session_token ` in ` cookie `

  - Session cookie (browser auth)

## Request body (required)

Content type: ` application/json `

Request body

- ` value `: type ` object `

  - Required fields: ` name `, ` org_id `, ` env_id `

  - ` name `: type ` string ` — Display name for the key

    - example: ` "Production key" `

    - minLength: ` 1 `

  - ` org_id `: type ` string ` — Organization ID

    - minLength: ` 1 `

  - ` env_id `: type ` string ` — Environment ID

    - minLength: ` 1 `

  - ` scopes `: type ` string ` — Scopes (default: *)

    - example: ` "*" `

## Responses

### ` 201 ` — API key created (key shown once)

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` id `, ` name `, ` key `, ` key_prefix `, ` scopes `, ` created_at `

  - ` id `: type ` string ` — Key ID

  - ` name `: type ` string ` — Display name

  - ` key `: type ` string ` — Full API key (shown once)

  - ` key_prefix `: type ` string ` — Key prefix for identification

  - ` scopes `: type ` string ` — Scopes

  - ` created_at `: type ` string ` — ISO timestamp

### ` 400 ` — Bad request

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string ` — Error message

### ` 401 ` — Unauthorized

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string ` — Error message

### ` 404 ` — Environment not found

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string ` — Error message

## Request examples

### cURL

```curl
curl -X POST 'https://hookstream.io/v1/auth/api-keys' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Production key",
  "org_id": "string",
  "env_id": "string",
  "scopes": "*"
}'
```

### JavaScript

```javascript
const response = await fetch('https://hookstream.io/v1/auth/api-keys', {
  method: 'POST',
  headers: {
      "Authorization": "Bearer YOUR_API_TOKEN",
      "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "name": "Production key",
    "org_id": "string",
    "env_id": "string",
    "scopes": "*"
  })
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

headers = {
    'Authorization': 'Bearer YOUR_API_TOKEN'
}

response = requests.post('https://hookstream.io/v1/auth/api-keys', headers=headers, json={
  "name": "Production key",
  "org_id": "string",
  "env_id": "string",
  "scopes": "*"
})
print(response.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
  "name": "Production key",
  "org_id": "string",
  "env_id": "string",
  "scopes": "*"
}`)
	req, _ := http.NewRequest("POST", "https://hookstream.io/v1/auth/api-keys", body)
	req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	result, _ := io.ReadAll(resp.Body)
	fmt.Println(string(result))
}
```