---
title: "Create a builder API key"
description: "Mint a key acting as you, the builder, in one named organisation, narrowed to chosen scopes."
canonical: "https://grid82.com/docs/builder-api/keys/create"
updated: "2026-11-13"
---

# Create a builder API key

`POST https://studio.grid82.app/v1/keys`

Mint a key acting as you, the builder, in one named organisation, narrowed to chosen scopes.

Requires a signed-in browser; keys and connected agents cannot mint keys. Expires in 90 days unless otherwise specified; `expiresInDays: null` means it lives until revoked. Returned once and never stored in clear. For CI and CLI use without a browser.

Any valid credential for this API: no scope is needed. Operation `keys.create`. Not an MCP tool. Minting a credential from a credential is how one leaked token becomes a permanent one. Keys are made by a person in a signed-in browser, never by a connected agent. CLI: `grid82 keys create` (`npx grid82`).

## Headers

| Name              | Type   | Required | Description                                                                                                                                                                                                                                                        |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Idempotency-Key` | string | no       | Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters. |

## Request body

| Field            | Type            | Required | Description          |
| ---------------- | --------------- | -------- | -------------------- |
| `organizationId` | string          | yes      |                      |
| `name`           | string          | yes      | Up to 60 characters. |
| `scopes`         | string\[]       | yes      |                      |
| `expiresInDays`  | integer or null | no       |                      |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**201**: Success

- `data` (`object`, required)
- `data.id` (`string`, required)
- `data.kind` (`enum<string>`, required, one of: `key, oauth`)
- `data.name` (`string`, required)
- `data.keyId` (`string`, required)
- `data.scopes` (`string[]`, required)
- `data.clientId` (`string,null`, required)
- `data.appIds` (`string[] | null`, required)
- `data.createdAt` (`string`, required)
- `data.expiresAt` (`string,null`, required)
- `data.lastUsedAt` (`string,null`, required)
- `data.key` (`string`, required)

```json
{
  "data": {
    "id": "<string>",
    "kind": "key",
    "name": "<string>",
    "keyId": "<string>",
    "scopes": [
      "<string>"
    ],
    "clientId": null,
    "appIds": [
      "<string>"
    ],
    "createdAt": "<string>",
    "expiresAt": null,
    "lastUsedAt": null,
    "key": "<string>"
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request POST \
  --url 'https://studio.grid82.app/v1/keys' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "organizationId": "<string>",
  "name": "<string>",
  "scopes": [
    "<string>"
  ]
}'
```