## Create a new API key

**post** `/v1/api_keys`

Creates a new API key in the workspace.

### Body Parameters

- `metadata: CreateResourceMetadata`

  CreateResourceMetadata contains the user-provided fields for creating
  a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id,
  created_at) are excluded since they are set by the server.

  - `name: string`

    Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")

  - `externalId: optional string`

    External ID for the resource (e.g., a workflow ID from an external system)

  - `labels: optional map[string]`

    Arbitrary key-value pairs for categorization and filtering
    Examples: {"environment": "production", "team": "platform", "version": "v2"}

- `spec: APIKeySpec`

  APIKeySpec contains the API Key-specific fields

  - `token: optional string`

    The actual token value (only returned on creation and rotation, read-only)

  - `description: optional string`

    Description of what this API Key is used for

### Returns

- `APIKey = object { metadata, spec, info }`

  APIKey represents a workspace-scoped API key.
  Each API key belongs to exactly one workspace, ensuring workspace isolation.
  Authentication is handled via Cadenya-issued JWTs signed with the key's own signing secret.

  - `metadata: ResourceMetadata`

    Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

    - `id: string`

      Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

    - `accountId: string`

      Account this resource belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this resource was created

    - `name: string`

      Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
      Required for resources that users interact with directly

    - `profileId: string`

      ID of the actor (user or service account) that created this resource

    - `workspaceId: string`

      Workspace this resource belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the resource (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"environment": "production", "team": "platform", "version": "v2"}

  - `spec: APIKeySpec`

    APIKeySpec contains the API Key-specific fields

    - `token: optional string`

      The actual token value (only returned on creation and rotation, read-only)

    - `description: optional string`

      Description of what this API Key is used for

  - `info: optional APIKeyInfo`

    - `createdBy: optional Profile`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: AccountResourceMetadata`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `spec: ProfileSpec`

        ProfileSpec contains the profile-specific fields

        - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

          Type is the type of profile. User's are humans, API keys are computers. You know the deal.

          - `"PROFILE_TYPE_USER"`

          - `"PROFILE_TYPE_API_KEY"`

          - `"PROFILE_TYPE_SYSTEM"`

        - `email: optional string`

          Email address of the user (required, unique per account)

        - `name: optional string`

          Display name for the user (e.g., "Bobby Tables")

### Example

```http
curl https://api.cadenya.com/v1/api_keys \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CADENYA_API_KEY" \
    -d '{
          "metadata": {
            "name": "name"
          },
          "spec": {}
        }'
```

#### Response

```json
{
  "metadata": {
    "id": "id",
    "accountId": "accountId",
    "createdAt": "2019-12-27T18:11:19.117Z",
    "name": "name",
    "profileId": "profileId",
    "workspaceId": "workspaceId",
    "externalId": "externalId",
    "labels": {
      "foo": "string"
    }
  },
  "spec": {
    "token": "token",
    "description": "description"
  },
  "info": {
    "createdBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    }
  }
}
```