---
title: Create an API key
description: Creates a personal API key for the caller, or a workspace key when owner is workspace.
doc_version: 0.1.0-preview
last_updated: 2026-09-14
---

# Create an API key

`POST /v1/workspaces/{workspaceId}/api-keys`

Creates a personal API key for the caller, or a workspace key when owner is workspace. A viewer can create a personal key. An admin is required for a workspace key. The key works on the API, the storage API, and S3 tools. It appears once.

## Authentication

Send `Authorization: Bearer <GRAPHON_API_KEY>`. Read the key from the
GRAPHON_API_KEY environment variable. Never print it.

## Path parameters

- `workspaceId` (string) — The workspace id.

## Request body

- `name` (string) — Display name.
- `owner` (string (optional)) — Who owns the key. Defaults to me. One of: me, workspace.
- `role` (string (optional)) — Role for the new key. It cannot exceed your role. Defaults to your role for a personal key and to viewer for a workspace key. One of: viewer, editor, admin.
- `expiresAt` (string (optional)) — Optional expiry in UTC. The time must be in the future.

## Example request

```bash
curl \
  --url "https://api.graphon.ai/v1/workspaces/wspq7ws2np5l8z4/api-keys" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"name":"Local CLI"}'
```

## CLI

```bash
graphon api-keys create --name ingest-bot
```

## Example response

```json
{
  "key": {
    "id": "apkE5f6G7h8I9",
    "workspaceId": "wspq7ws2np5l8z4",
    "name": "Local CLI",
    "maskedKey": "gak_GAK1a8Xk2mQ9pL0vT4cZ.••••",
    "ownerKind": "user",
    "ownerUserId": "usrB2c3D4e5F6",
    "createdByUserId": "usrB2c3D4e5F6",
    "role": "viewer",
    "createdAt": "2026-09-14T18:00:00.000Z",
    "lastUsedAt": null,
    "expiresAt": null,
    "revokedAt": null,
    "revision": 1
  },
  "apiKey": "gak_GAK1a8Xk2mQ9pL0vT4cZ.<shown once>"
}
```

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.