> ## Documentation Index
> Fetch the complete documentation index at: https://docs.modulex.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Create a new API key. The full key (`key`) is returned ONLY in this response — save it securely, it cannot be retrieved later. Optionally scope the key to a single organization and/or set an expiry.



## OpenAPI

````yaml /api-reference/openapi.json post /api-keys
openapi: 3.0.3
info:
  title: ModuleX API
  version: 0.1.2
  description: >-
    ModuleX REST API. Authenticate with a user API key (`Authorization: Bearer
    mx_live_*`, or the `X-API-KEY` header) and supply the organization context
    header `X-Organization-ID` on org-scoped endpoints. Routers carry NO `/v1`
    version segment. Billing-gated surfaces (workflow run, managed knowledge
    search) reject before any write with a flat `DenialEnvelope` (402/403/429).
servers:
  - url: https://api.modulex.dev
    description: Production
security:
  - bearerAuth: []
    orgHeader: []
tags:
  - name: Workflows
    description: Create, read, update and delete workflow definitions.
  - name: Runs
    description: Execute workflows. Subject to the billing admission gate.
  - name: Schedules
    description: Recurring (cron / interval) workflow executions.
  - name: Knowledge
    description: Knowledge bases and semantic search.
  - name: Credentials
    description: Integration credentials (API key, bearer, OAuth2, ModuleX-managed).
  - name: Integrations
    description: Catalog of available tools, LLM providers and knowledge providers.
  - name: Organizations
    description: Organization management.
  - name: API keys
    description: User-owned API keys for programmatic access.
paths:
  /api-keys:
    post:
      tags:
        - API keys
      summary: Create an API key
      description: >-
        Create a new API key. The full key (`key`) is returned ONLY in this
        response — save it securely, it cannot be retrieved later. Optionally
        scope the key to a single organization and/or set an expiry.
      operationId: createApiKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
      responses:
        '201':
          description: The created API key, including the one-time plaintext `key`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateApiKeyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          $ref: '#/components/responses/ValidationError'
components:
  schemas:
    CreateApiKeyRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
          description: Friendly name (e.g. 'Production Server').
          example: Production API Key
        organization_id:
          type: string
          nullable: true
          description: >-
            Scope the key to one organization. If null, the key works for all
            the user's organizations.
        expires_at:
          type: string
          format: date-time
          nullable: true
          description: Expiry (ISO 8601). If null, never expires.
        rate_limit_per_minute:
          type: integer
          default: 60
          minimum: 1
          maximum: 1000
          description: Max requests per minute for this key.
    CreateApiKeyResponse:
      allOf:
        - $ref: '#/components/schemas/ApiKey'
        - type: object
          required:
            - key
          properties:
            key:
              type: string
              description: Full API key, shown ONLY ONCE. Save it securely.
              example: mx_live_2J9vK4xM8nP3wQ7tR5sL1yB6cF0dG2h4vN8pX5mK9rT3wY7u
    ApiKey:
      type: object
      description: API key details (without the secret).
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        key_hint:
          type: string
          description: First 8 characters of the key.
          example: 2J9vK4xM
        masked_key:
          type: string
          example: mx_live_2J9vK4xM********
        organization_id:
          type: string
          nullable: true
          description: Organization scope (null = all orgs).
        expires_at:
          type: string
          format: date-time
          nullable: true
        is_expired:
          type: boolean
        is_active:
          type: boolean
        rate_limit_per_minute:
          type: integer
        last_used_at:
          type: string
          format: date-time
          nullable: true
        created_at:
          type: string
          format: date-time
        revoked_at:
          type: string
          format: date-time
          nullable: true
    Error:
      type: object
      description: Standard FastAPI error response.
      properties:
        detail:
          description: >-
            Human-readable error message, or a structured object (some endpoints
            return `{message, code, ...}`).
          oneOf:
            - type: string
            - type: object
              additionalProperties: true
    HTTPValidationError:
      type: object
      properties:
        detail:
          type: array
          items:
            $ref: '#/components/schemas/ValidationErrorItem'
    ValidationErrorItem:
      type: object
      required:
        - loc
        - msg
        - type
      properties:
        loc:
          type: array
          items:
            oneOf:
              - type: string
              - type: integer
        msg:
          type: string
        type:
          type: string
  responses:
    BadRequest:
      description: The request was malformed or failed a business rule.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: >-
        Authentication required or invalid. Provide `Authorization: Bearer
        <key>` or `X-API-KEY`.
      headers:
        WWW-Authenticate:
          schema:
            type: string
          description: Bearer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ValidationError:
      description: Request validation failed (FastAPI 422).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HTTPValidationError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        User API key: `Authorization: Bearer mx_live_*`. The `X-API-KEY:
        mx_live_*` header is also accepted.
    orgHeader:
      type: apiKey
      in: header
      name: X-Organization-ID
      description: Required organization context for org-scoped endpoints.

````