# Create keys — POST /v1/iam/keys URL: https://docs.hanzo.ai/docs/openapi/iam/post-iam-keys > Issues an API key. `POST /v1/iam/keys` > [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/iam/keys` | | **Method** | `POST` | | **Operation** | `post_iam_keys` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Issues an API key. A standard key comes back as a publishable half you may ship in client code and a secret half you must not — the secret is shown once, at creation, and cannot be retrieved afterwards. A publish-scoped key is issued with the publishable half only, so there is no secret to leak. A name already used in your organization is refused rather than reissued, so creating twice never silently invalidates a key that is in production. A key you create is yours: it names you as its holder and speaks for you in the organization it is filed in. Naming anyone else as its holder is refused; a SuperAdmin names the person a key is for. ## Request 24 fields, body `application/json` (required). | Field | In | Type | Required | Description | | -------------------- | ---- | ------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `accessKey` | body | string | — | AccessKey (pk-\*) is the publishable identifier and lookup index; AccessSecret (sk-\*) is the confidential secret. | | `accessSecret` | body | string | — | | | `accessSecretDigest` | body | string | — | AccessSecretDigest is how a presented secret finds its key: the resolver digests what the caller sent and looks THAT up. | | `act` | body | boolean | — | Act is the durable, opt-in grant that lets this key act FOR a user in its own org — the credential behind as(): presenting it authorizes minting a short-lived, user-bound token for a member of the key's tenant. | | `application` | body | string | — | | | `createdAt` | body | string (date-time) | — | | | `createdTime` | body | string | — | CreatedTime and UpdatedTime are RFC3339 audit stamps carried as strings for byte-parity with the v1 row (orm.Model separately tracks CreatedAt / UpdatedAt as time.Time for the store's own lifecycle). | | `deleted` | body | boolean | — | | | `displayName` | body | string | — | DisplayName is the human-facing label. | | `expireTime` | body | string | — | ExpireTime is when the key stops being honored (empty = never). | | `id` | body | string | — | | | `name` | body | string | — | | | `organization` | body | string | — | | | `owner` | body | string | — | Owner is the tenant that holds the key; Name is unique within Owner. | | `prefix` | body | string | — | Prefix is the head of the credential the holder presents — the sk- of a secret key, the pk- of a publishable one — recorded when the key is minted (PrefixOf). | | `revokeTime` | body | string | — | | | `revoker` | body | string | — | Revoker is who revoked the key and RevokeTime when. | | `scope` | body | string | — | Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound principal). | | `state` | body | string | — | | | `type` | body | string | — | Type is the scope the key is bound to — "Organization", "Application", "User", or "General" — and Organization / Application / User name the concrete principal for whichever scope Type selects. | | `updatedAt` | body | string (date-time) | — | | | `updatedTime` | body | string | — | | | `usedTime` | body | string | — | UsedTime is when the key was last presented and resolved. | | `user` | body | string | — | | ## Response | Status | Body | Meaning | | --------- | --------------- | ----------------- | | `200` | iam.Key | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 24 fields. | Field | In | Type | Always | Description | | -------------------- | ---- | ------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `accessKey` | body | string | — | AccessKey (pk-\*) is the publishable identifier and lookup index; AccessSecret (sk-\*) is the confidential secret. | | `accessSecret` | body | string | — | | | `accessSecretDigest` | body | string | — | AccessSecretDigest is how a presented secret finds its key: the resolver digests what the caller sent and looks THAT up. | | `act` | body | boolean | — | Act is the durable, opt-in grant that lets this key act FOR a user in its own org — the credential behind as(): presenting it authorizes minting a short-lived, user-bound token for a member of the key's tenant. | | `application` | body | string | — | | | `createdAt` | body | string (date-time) | — | | | `createdTime` | body | string | — | CreatedTime and UpdatedTime are RFC3339 audit stamps carried as strings for byte-parity with the v1 row (orm.Model separately tracks CreatedAt / UpdatedAt as time.Time for the store's own lifecycle). | | `deleted` | body | boolean | — | | | `displayName` | body | string | — | DisplayName is the human-facing label. | | `expireTime` | body | string | — | ExpireTime is when the key stops being honored (empty = never). | | `id` | body | string | — | | | `name` | body | string | — | | | `organization` | body | string | — | | | `owner` | body | string | — | Owner is the tenant that holds the key; Name is unique within Owner. | | `prefix` | body | string | — | Prefix is the head of the credential the holder presents — the sk- of a secret key, the pk- of a publishable one — recorded when the key is minted (PrefixOf). | | `revokeTime` | body | string | — | | | `revoker` | body | string | — | Revoker is who revoked the key and RevokeTime when. | | `scope` | body | string | — | Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound principal). | | `state` | body | string | — | | | `type` | body | string | — | Type is the scope the key is bound to — "Organization", "Application", "User", or "General" — and Organization / Application / User name the concrete principal for whichever scope Type selects. | | `updatedAt` | body | string (date-time) | — | | | `updatedTime` | body | string | — | | | `usedTime` | body | string | — | UsedTime is when the key was last presented and resolved. | | `user` | body | string | — | | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo iam keys create ``` **SDK** **.ts** ```ts import { Configuration, IamApi } from 'hanzoai'; const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.postIamKeys({ accessKey: "", accessSecret: "" }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import IamApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = IamApi(client).post_iam_keys(access_key="", access_secret="") ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.IamAPI.PostIamKeys(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, iam_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = iam_api::post_iam_keys(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.IamApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new IamApi(client).postIamKeys(); ``` **HTTP** ```bash curl -X POST https://api.hanzo.ai/v1/iam/keys \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "accessKey": "", "accessSecret": "" }' ``` **MCP** MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_iam_applications" } } }' ``` --- [IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)