> ## Documentation Index > Fetch the complete documentation index at: https://cactal.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create an API key > Creates an API key that authenticates as its own principal within the organization. `access` grants either one organization-wide role (`admin`, `full_editor`, or `content_editor`) or one role (`full_editor` or `content_editor`) on at least one website in the organization; the `owner` role can never be granted, and website ids outside the organization fail with 400. `name` is 1–200 characters and `expiresAt` is an ISO 8601 timestamp or `null` for a key that never expires. The response contains the plaintext secret exactly once — only a SHA-256 hash is stored, so it cannot be retrieved again. ## OpenAPI ````yaml /api-reference/openapi.json post /apiKeys openapi: 3.1.0 info: title: Cactal API version: 1.0.0 description: >- The Cactal public API. Create, edit, publish, and operate websites programmatically. Authenticate every request with an API key sent as `Authorization: Bearer `. servers: - url: https://api.cactal.ai/v1 security: - apiKey: [] tags: - name: Documentation description: >- Search and read the Cactal product documentation for concepts, guides, agent workflows, platform behavior, and API operations. - name: Feedback description: >- Submit free-form product feedback from users and agents to the Cactal feedback inbox. - name: Websites description: >- Create and manage websites — the top-level resource that owns source code, content, assets, domains, and analytics. - name: Website editors description: >- Grant, list, and revoke website-scoped editor access, and invite collaborators to a single website by email. - name: API keys description: >- Create, scope, rotate, and revoke the API keys that authenticate programmatic and agent access. - name: Source code description: >- Read and edit the framework source files of a website draft. Mutations require an edit lease. - name: Publishing description: Validate, build, publish, and roll back website versions. - name: CMS collections description: >- Define the content model: collections of structured content owned by a website. - name: CMS fields description: Manage the typed fields that make up a collection schema. - name: CMS items description: >- Create, query, publish, and organize the content entries inside a collection. - name: Domains description: >- Manage platform subdomains and custom domains, including DNS verification and the primary domain. - name: Assets description: Upload and manage website files and images served from the Cactal CDN. - name: Media generation description: >- Generate reference-guided website images that are stored as ordinary Cactal CDN assets. - name: Project Context description: >- Upload private durable reference material that the website agent can search, read, and inspect. - name: Analytics description: >- Read first-party traffic analytics for a website and export datasets as CSV. - name: Organizations description: Manage organizations, members, and organization-wide invitations. - name: Audit log description: >- Read the immutable record of actions performed in an organization by users and API keys. - name: Billing description: >- Read billing state and manage plans, site capacity, and prepaid usage balance. Every billing operation requires the organization owner role, which API keys cannot hold — today these operations are performed from the dashboard, return 403 for API-key callers, and are hidden from MCP tool lists. paths: /apiKeys: post: tags: - API keys summary: Create an API key description: >- Creates an API key that authenticates as its own principal within the organization. `access` grants either one organization-wide role (`admin`, `full_editor`, or `content_editor`) or one role (`full_editor` or `content_editor`) on at least one website in the organization; the `owner` role can never be granted, and website ids outside the organization fail with 400. `name` is 1–200 characters and `expiresAt` is an ISO 8601 timestamp or `null` for a key that never expires. The response contains the plaintext secret exactly once — only a SHA-256 hash is stored, so it cannot be retrieved again. operationId: apiKeys.create requestBody: required: true content: application/json: schema: type: object properties: organizationId: type: string minLength: 1 name: type: string minLength: 1 maxLength: 200 expiresAt: anyOf: - {} - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' access: oneOf: - type: object properties: kind: type: string const: organization description: Grants one role across the entire organization. role: type: string enum: - admin - full_editor - content_editor description: Organization-wide role held by the key. required: - kind - role - type: object properties: kind: type: string const: websites description: Grants one role on an explicit set of websites. websiteIds: minItems: 1 type: array items: type: string minLength: 1 description: >- Ids of the websites the key can access. All must belong to the organization of the key. role: type: string enum: - content_editor - full_editor description: Role held by the key on each listed website. required: - kind - websiteIds - role description: >- Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key. required: - organizationId - name - expiresAt - access responses: '200': description: >- The created key and its `plaintextKey` secret. Store the secret now; it is never shown again. content: application/json: schema: type: object properties: apiKey: type: object properties: id: type: string description: Unique id of the API key. name: type: string description: Human-readable label, 1–200 characters. organizationId: type: string description: Id of the organization that owns the key. access: oneOf: - type: object properties: kind: type: string const: organization description: >- Grants one role across the entire organization. role: type: string enum: - admin - full_editor - content_editor description: Organization-wide role held by the key. required: - kind - role additionalProperties: false - type: object properties: kind: type: string const: websites description: >- Grants one role on an explicit set of websites. websiteIds: minItems: 1 type: array items: type: string minLength: 1 description: >- Ids of the websites the key can access. All must belong to the organization of the key. role: type: string enum: - content_editor - full_editor description: Role held by the key on each listed website. required: - kind - websiteIds - role additionalProperties: false description: >- Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key. expiresAt: anyOf: - type: string format: date-time - type: 'null' description: >- When the key stops authenticating. `null` when it never expires. revokedAt: anyOf: - type: string format: date-time - type: 'null' description: >- When the key was revoked. `null` while the key is active. createdAt: description: When the key was created. type: string format: date-time required: - id - name - organizationId - access - expiresAt - revokedAt - createdAt additionalProperties: false description: Metadata and access configuration of the key. plaintextKey: type: string description: >- The plaintext secret, a 32-byte base64url string. Store it now; it is never shown again, and only a SHA-256 hash is kept. required: - apiKey - plaintextKey additionalProperties: false '400': description: >- Validation failed. The response `message` names the first invalid field. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '401': description: Missing, invalid, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '403': description: The authenticated principal lacks the required capability. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '404': description: >- The resource does not exist or is outside the principal’s access scope. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '429': description: >- Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header. content: application/json: schema: $ref: '#/components/schemas/ServiceError' components: schemas: ServiceError: type: object required: - kind - message description: >- Canonical error body returned by every non-2xx response. Extra fields carry error-specific details. properties: kind: type: string enum: - validation - unauthorized - forbidden - not_found - conflict - rate_limited - internal description: Stable, machine-readable error category. message: type: string description: Human-readable explanation of the failure. suggestion: type: string description: >- What to do next when the failure has a known fix; may name the exact operation to call. validValues: type: array items: type: string description: The acceptable values for the failing field, when the set is closed. additionalProperties: true securitySchemes: apiKey: type: http scheme: bearer description: >- Cactal API key. Create one in the dashboard or via `POST /apiKeys`. The plaintext key is shown once at creation. ````