---
type: api
title: Create API key
description: Creates a new API key.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud/operation/operation-create-api-key
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud/operation/operation-create-api-key
products:
  - Elastic Cloud Hosted
---

# Create API key

- Server: `https://api.elastic-cloud.com/api/v1`

## Paths

- `POST` `/users/auth/keys`

## Description

Creates a new API key.

## Request Body

`application/json`

The request to create the API key

- `description` (string) — required
  API key description. Useful if there are multiple keys
- `expiration` (string) — optional
  The optional expiration for the API key, provided as a duration (ex: '1d', '3h')
- `role_assignments` ({} RoleAssignments) — optional
  Roles assigned to users, API keys or organization invitations. Currently unavailable in self-hosted ECE.
  - `platform` ([] PlatformRoleAssignment) — optional
    Assignments for roles with platform scope.
    - `role_id` (string) — required
      The ID of the role that is assigned.
  - `organization` ([] OrganizationRoleAssignment) — optional
    Assignments for roles with organization scope.
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project
  - `deployment` ([] DeploymentRoleAssignment) — optional
    Assignments for roles with deployment scope.
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `all` (boolean) — optional
      When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in `deployment_ids`.
    - `deployment_ids` ([] string) — optional
      The IDs of the deployments the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.
  - `project` ({} ProjectRoleAssignments) — optional
    Assignments for roles with project scope.
    - `elasticsearch` ([] ProjectRoleAssignment) — optional
      The Elasticsearch project-scoped role assignments to set
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `all` (boolean) — optional
        When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
      - `project_ids` ([] string) — optional
        The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` ([] string) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
    - `observability` ([] ProjectRoleAssignment) — optional
      The Observability project-scoped role assignments to set
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `all` (boolean) — optional
        When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
      - `project_ids` ([] string) — optional
        The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` ([] string) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
    - `security` ([] ProjectRoleAssignment) — optional
      The Security project-scoped role assignments to set
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `all` (boolean) — optional
        When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
      - `project_ids` ([] string) — optional
        The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` ([] string) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
    - `workplaceai` ([] ProjectRoleAssignment) — optional
      The WorkplaceAI project-scoped role assignments to set
      - `role_id` (string) — required
        The ID of the role that is assigned.
      - `organization_id` (string) — required
        The ID of the organization the role is scoped to.
      - `all` (boolean) — optional
        When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
      - `project_ids` ([] string) — optional
        The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
      - `application_roles` ([] string) — optional
        If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

## Responses

#### `201`

The API key is created and returned in the body of the response.

`application/json`

- `id` (string)
  The API key ID.
- `user_id` (string)
  The user ID.
- `organization_id` (string)
  The organization ID linked to the API key
- `description` (string)
  The API key description. TIP: Useful when you have multiple API keys.
- `key` (string)
  The API key. TIP: Since the API key is returned only once, save it in a safe place.
- `creation_date` (string)
  The date/time for when the API key is created.
- `expiration_date` (string)
  The date/time when the API key expires.
- `role_assignments` ({} RoleAssignments)
  Roles assigned to users, API keys or organization invitations. Currently unavailable in self-hosted ECE.
  Same fields as `role_assignments`
#### `400`

The request is invalid. Specify a different request, then try again. (code: `api_keys.invalid_input`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code Examples

#### Console

```console
POST /users/auth/keys
```

#### curl

```curl
curl -X POST "https://api.elastic-cloud.com/api/v1/users/auth/keys"
```