> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lehar.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

> Creates an API key. The raw `key` is returned **only once** in this response — store it in a secrets manager. Requires the `api_keys:write` scope. Every requested scope must be one the calling credential already holds; requesting a broader scope returns `403` and creates nothing.



## OpenAPI

````yaml /api-reference/openapi.json post /workspace/api-keys
openapi: 3.1.0
info:
  title: Lehar API
  version: v0
  description: >-
    Customer-facing REST API for the Lehar voice-AI platform. Platform-admin
    endpoints are intentionally excluded from this reference. Regenerate with
    `npm run sync:openapi`.
servers:
  - url: https://api.lehar.ai/ca/api/v0
security:
  - ApiKeyAuth: []
  - BearerAuth: []
paths:
  /workspace/api-keys:
    post:
      tags:
        - Workspace
      summary: Create API key
      description: >-
        Creates an API key. The raw `key` is returned **only once** in this
        response — store it in a secrets manager. Requires the `api_keys:write`
        scope. Every requested scope must be one the calling credential already
        holds; requesting a broader scope returns `403` and creates nothing.
      operationId: create_api_key_ca_api_v0_workspace_api_keys_post
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - scopes
              properties:
                name:
                  type: string
                  description: Human label for the key.
                scopes:
                  type: array
                  items:
                    type: string
                  description: >-
                    Scopes granted to the key. Must be a subset of the calling
                    credential's own scopes.
                expires_at:
                  type:
                    - string
                    - 'null'
                  format: date-time
                  description: Optional expiry; null for no expiry.
            example:
              name: backend
              scopes:
                - sessions:read
                - sessions:write
              expires_at: null
      responses:
        '201':
          description: Created key (raw `key` shown once)
          content:
            application/json:
              example:
                id: key_01EXAMPLE
                name: backend
                key: lk_live_3Qa1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8S9t0
                prefix: lk_live_3Qa1
                scopes:
                  - sessions:read
                  - sessions:write
                status: active
                created_at: '2026-05-22T10:00:00Z'
                expires_at: null
        '400':
          description: Invalid request
          content:
            application/json:
              example:
                error:
                  code: invalid_request
                  message: scopes must be a non-empty list
        '403':
          description: Missing api_keys:write, or requesting scopes beyond the caller's own
          content:
            application/json:
              example:
                error:
                  code: forbidden
                  message: 'Cannot grant scopes the caller does not hold: billing:write'
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-KEY
    BearerAuth:
      type: http
      scheme: bearer

````