# flow2act · Create an API key

Create a restricted server credential with an expiry or an explicit service-account exception. Store the secret from the first response securely.

Expiry: 1–365 days, default 30. Set expiresInDays to null only with an active serviceAccountId to issue a key without expiration. Such keys remain valid until revoked; restrict their permissions and replace them regularly. Maximum 200 records per workspace including revoked keys. Secrets are never replayed. Revoke and replace lost keys.

Set serviceAccountId for organization-owned keys. Every requested scope must fit the active account permission ceiling; users:invite always requires a service account. Secrets are shown once. Create a second key and revoke the first for rotation.

## POST /v1/api-keys

Authentication: FLOW2ACT_ACCESS_TOKEN from flow2act sign-in
Required tenant header: X-Organization-Id.
Required user permissions: Administrator or Sandbox developer required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Input parameters
- name (string, required): min length 1 · max length 80
- scopes (array, required): min items 1 · max items 7
- serviceAccountId (string, optional): uuid
- expiresInDays (integer, optional): min 1 · max 365 · default 30

## Request example (replace example IDs)

```sh
curl -X POST "https://api.flow2act.com/v1/api-keys" \
  -H "authorization: Bearer $FLOW2ACT_ACCESS_TOKEN" \
  -H "x-organization-id: 10000000-0000-4000-8000-000000000001" \
  -H "idempotency-key: example-create-key-001" \
  -H "content-type: application/json" \
  --data-raw '{
  "name": "Deployment integration",
  "scopes": [
    "runs:start",
    "runs:read",
    "flows:read"
  ],
  "expiresInDays": 30,
  "serviceAccountId": "10000000-0000-4000-8000-000000000010"
}'
```

## Response excerpt

```json
{
  "key": {
    "id": "10000000-0000-4000-8000-000000000008",
    "name": "Deployment integration"
  },
  "secret": "<shown only on first creation>",
  "replayed": false
}
```

Source: /docs/create-key
Full schemas: /docs/openapi.json