---
title: Create an API key
description: Creates a personal API key for the caller, or a service-account key when owner.kind is service_account.
doc_version: 0.1.0-preview
last_updated: 2026-09-14
---

# Create an API key

`POST /v1/workspaces/{workspaceId}/api-keys`

Creates a personal API key for the caller, or a service-account key when owner.kind is service_account. A viewer key can create a personal key. An admin key is required for a service-account key. The secret and bearer token appear once.

## Authentication

Send `Authorization: Bearer <SPARK_API_KEY>`. Read the key from the
SPARK_API_KEY environment variable. Never print it.

## Path parameters

- `workspaceId` (string) — The workspace id.

## Request body

- `name` (string) — Display name.
- `role` (string (optional)) — Role for the new key. A key cannot exceed the owner's role. One of: viewer, editor, admin.
- `expiresAt` (string (optional)) — Optional expiry in UTC. The time must be in the future.
- `owner` (object (optional)) — Service-account owner. Omit this object for a personal key.

## Example request

```bash
curl \
  --url "https://api.beta.graphon.ai/v1/workspaces/wspQ7WsH2Np5L/api-keys" \
  --header "Authorization: Bearer $SPARK_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"name":"Local CLI","role":"viewer"}'
```

## Example response

```json
{
  "key": {
    "id": "keyE5f6G7h8I9",
    "workspaceId": "wspQ7WsH2Np5L",
    "name": "Local CLI",
    "accessKeyId": "GSK0123456789ABCDE",
    "ownerKind": "user",
    "ownerId": "usrB2c3D4e5F6",
    "role": "viewer",
    "createdAt": "2026-09-14T18:00:00.000Z",
    "lastUsedAt": null,
    "expiresAt": null,
    "revokedAt": null,
    "revision": 1
  },
  "secret": "<secret shown once>",
  "bearerToken": "gsk_<accessKeyId>.<secret>"
}
```

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.