# Create a scoped API key

`POST /v1/api-keys`

**In this build:** Real.

**Scope:** `account.admin`

**CLI:** `harebox api-key new`

Send an `Idempotency-Key` header. A retry with the same key never repeats the action.

## Request: `CreateApiKeyRequest`

| Field | Type | Notes |
|---|---|---|
| `name` (required) | `string` |  |
| `scopes` | `array` |  |
| `preset` | `string` | One of: `read_only`, `full_sandbox`, `ci`, `tenant`, `admin` |
| `sandboxes` | `array` |  |
| `projects` | `array` |  |
| `environments` | `array` |  |
| `label_selector` | `string` |  |
| `ip_allowlist` | `array` |  |
| `monthly_budget_usd` | `number` |  |
| `rate_limit_per_minute` | `integer` |  |
| `ttl_seconds` | `integer or null` | Default 90 days. Null means no expiry and requires account.admin. |

## Response: 201

`ApiKeyWithSecret`

`ApiKeyWithSecret`

Errors follow [one format](../errors.html).