Create an API key
Creates a secret key, optionally limited to some project permissions and given an expiry.
The response is the only time its rawKey is shown. A key cannot carry a permission its creator lacks. Only a person signed in to the Voidhash dashboard can do this; a secret key, a CLI key or an MCP client cannot.
Guide: API keys
A project secret key: vh_sk_... for production, vh_sk_test_... for test. Keep it on your servers.
In: header
Path parameters
The project's id, proj_.... A secret key works only in the project it belongs to.
Request body
application/json
TypeScript definitions
Use the request body type in TypeScript.
What the key is for, 1 to 255 characters.
1 <= length <= 255test for a key that reads and reports test purchases, such as a staging server's. Defaults to production; fixed for the key's lifetime.
Project permissions the key is limited to for its lifetime, such as project:read and project:analytics:read for read-only analytics. Omit for full access. A key cannot carry a permission its creator lacks.
When the key stops working, an ISO 8601 timestamp in the future. Omit for a key that never expires.
Examples
curl -X POST "https://api.voidhash.com/api/v1/projects/proj_tz4a98xxat96iws9zmbrgj3a/api-keys" \ -H "Authorization: Bearer vh_sk_..." \ -H "Content-Type: application/json" \ -d '{ "name": "Production backend", "environment": "production", "scopes": [ "project:read", "project:persons:write", "project:entitlements:read" ] }'{ "id": "api_sk_r6t9y2u5i8o1p4a7s0d3f6g9", "projectId": "proj_tz4a98xxat96iws9zmbrgj3a", "name": "Production backend", "type": "secret", "environment": "production", "prefix": "vh_sk_", "end": "f3Qa", "rawKey": "vh_sk_...f3Qa", "scopes": [ "project:read", "project:persons:write", "project:entitlements:read" ], "expiresAt": null, "lastUsedAt": null, "previousKeyExpiresAt": null, "createdAt": "2026-02-01T08:00:00.000Z"}{ "error": { "type": "invalid_request", "code": "expiry_not_in_future", "message": "A secret key's expiry must be in the future.", "param": "expiresAt" }}{ "error": { "type": "unauthenticated", "code": "invalid_api_key", "message": "This secret key is not valid." }}{ "error": { "type": "permission_denied", "code": "permission_denied", "message": "Insufficient permissions." }}{ "error": { "type": "not_found", "code": "project_not_found", "message": "There is no project proj_tz4a98xxat96iws9zmbrgj3a, or this credential cannot use it.", "param": "projectId" }}{ "error": { "type": "internal", "code": "internal_error", "message": "Something went wrong on our side. Try again, and contact support with the Request-Id header if it keeps failing." }}Response body
application/json
application/json
application/json
application/json
application/json
application/json
Errors
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request | expiry_not_in_future | For an expiry that has passed. |
It can also fail with the errors every operation shares, such as unauthenticated; see Errors.
More in API keys
- List API keys
GET - Retrieve an API key
GET - Update an API key
PATCH - Delete an API key
DELETE - Roll an API key
POST
Something wrong or missing on this page? Tell us by email or on Discord.