Create API Key

​

Issue a v5 scoped-permission API key on your own account (account_id is ignored — the key is always issued on the caller's own account). The plaintext key is returned exactly once in this response. You may only grant permissions you yourself hold.

Headers
  • Accept
    enum
    const:  
    application/json
    required

    Response format. Must be application/json.

    values
    • application/json
  • Content-Type
    enum
    const:  
    application/json
    required

    Request payload format. Must be application/json when a body is sent.

    values
    • application/json
Body·
required
application/json

Request body for creating a v5 scoped-permission API key. permissions must be non-empty and may only contain permissions the caller itself holds (privilege-escalation guard). legacy_all cannot be requested.

  • name
    Type: string · Name
    required
  • permissions
    Type: array string[] · Permissions 1… unique!enum
    required
    values
    • payments:tap-ios
    • payments:tap-android
    • payments:read
    • payments:refund
    • payments:tipadjust
  • account_id
    Type: string · Account Idnullable

    Ignored on /v5/apikeys — the key is always issued on the caller's own account.

  • expires_at
    Type: string · Expires AtFormat: date-timenullable

    Optional expiry. Defaults to a long-lived expiry when omitted.

Responses
  • application/json
  • application/json
  • application/json
  • application/json
  • application/json
Request Example for post/v5/apikeys
curl /v5/apikeys \
  --request POST \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
  "account_id": "",
  "name": "",
  "permissions": [
    "payments:tap-ios"
  ],
  "expires_at": ""
}'

{
  "id": "string",
  "account_id": "string",
  "name": "string",
  "key": "string",
  "key_last4": "string",
  "permissions": [
    "payments:tap-ios"
  ],
  "status": "active",
  "expires_at": "2026-07-10T18:41:46.997Z",
  "created_at": "2026-07-10T18:41:46.997Z",
  "last_used_at": "2026-07-10T18:41:46.997Z",
  "is_legacy": true
}

Key created (plaintext key returned once)