# POST /api/v1/account/api-keys

Create API key (self, step-up)

Operation: `createApiKey`.

Create API key (self, step-up)

Label, expiry and explicit renter/host scopes. Secret revealed once; only hash stored. No admin scopes or key-based MFA bypass.

## Endpoint

`POST https://amplerun-api.spiry.org/api/v1/account/api-keys`

## Authentication

Use the credential and scope required by this operation. For programmatic renter/host calls: `Authorization: Bearer $AMPLERUN_API_KEY`. A host-agent signature or other specialized proof is required where the description specifies it.

## Parameters

| Name | Location | Presence | Type | Description |
| --- | --- | --- | --- | --- |
| `Idempotency-Key` | header | Required | UUID | UUID scoped to authenticated principal, route and canonical request hash. |

## Request body

Required body. 

### `application/json`

| Field | Type | Presence | Description |
| --- | --- | --- | --- |
| `label` | string | Required |  |
| `expires_at` | Rfc3339Utc | Optional |  |
| `scopes` | array of "renter" / "host" | Required |  |

```json
{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "label",
    "scopes"
  ],
  "properties": {
    "label": {
      "type": "string",
      "minLength": 1
    },
    "expires_at": {
      "$ref": "#/components/schemas/Rfc3339Utc"
    },
    "scopes": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "enum": [
          "renter",
          "host"
        ]
      }
    }
  }
}
```

## Responses

### `201`

API key created; secret returned exactly once.

`application/json`
```json
{
  "allOf": [
    {
      "$ref": "#/components/schemas/ApiKeyView"
    },
    {
      "type": "object",
      "required": [
        "secret"
      ],
      "properties": {
        "secret": {
          "type": "string",
          "pattern": "^ark_",
          "description": "The API key. Store it now; it is not shown again."
        }
      }
    }
  ]
}
```

### `default`

Error envelope. 401 unauthenticated, 403/404 forbidden, 409 conflict, 422 invalid input, 429 rate limited (code UNAVAILABLE, retryable:true, no Retry-After header), 503 unavailable money/provider state with retryable:true.

`application/json`
| Field | Type | Presence | Description |
| --- | --- | --- | --- |
| `error` | object | Required |  |

```json
{
  "$ref": "#/components/schemas/ErrorEnvelope"
}
```

## Static request outline

Replace path/query placeholders and provide the required JSON body, headers and credential from the sections above. This is a request outline, not a command that chooses an amount or starts a rental for you.

```sh
curl --request POST 'https://amplerun-api.spiry.org/api/v1/account/api-keys' \
  --header "Authorization: Bearer $AMPLERUN_API_KEY"
```

[Schema definitions](https://docs.amplerun.com/reference/schemas.md) · [Download OpenAPI](/openapi.json) · [Authentication](https://docs.amplerun.com/agents/authentication.md) · [Errors and recovery](https://docs.amplerun.com/reference/errors.md)

---
Generated from the AmpleRun API contract.
Canonical: https://docs.amplerun.com/reference/api/create-api-key/