> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Key

> The plaintext `api_key` is returned exactly once. The requested scopes must
be covered by the caller's own API-key scopes.
Store the returned value in a secret manager before discarding the response.



## OpenAPI

````yaml /api-reference/customer-api.v1.openapi.json post /v1/admin/keys
openapi: 3.1.0
info:
  title: Mount Thor Customer API
  version: v1
servers:
  - description: Mount Thor customer API edge
    url: https://api.mountthor.com
security: []
paths:
  /v1/admin/keys:
    post:
      tags:
        - api-keys
      summary: Create Key
      description: >-
        The plaintext `api_key` is returned exactly once. The requested scopes
        must

        be covered by the caller's own API-key scopes.

        Store the returned value in a secret manager before discarding the
        response.
      operationId: create_customer_api_key_self_service
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomerApiKeyCreateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateCustomerApiKeyResponse'
          description: API key minted
        '400':
          description: Request body failed validation
        '401':
          description: Missing or invalid customer API key
        '403':
          description: API key is missing keys:write scope
        '409':
          description: Conflict
        '429':
          content:
            text/plain:
              schema:
                type: string
          description: Rate limit exceeded
          headers:
            Retry-After:
              description: Seconds before retry.
              schema:
                minimum: 1
                type: integer
      security:
        - api_key_bearer:
            - keys:write
components:
  schemas:
    CustomerApiKeyCreateRequest:
      additionalProperties: false
      description: Request body for customer self-service `POST /v1/admin/keys`.
      properties:
        api_key_id:
          description: Optional client-supplied UUID for the new API key.
          format: uuid
          type:
            - string
            - 'null'
        display_name:
          description: Human-readable label shown in customer tooling.
          maxLength: 160
          type: string
        expires_at:
          description: Optional expiry timestamp in RFC 3339 form.
          example: '2027-01-01T00:00:00Z'
          maxLength: 80
          type:
            - string
            - 'null'
        scopes:
          description: Allowed scopes for the new key. Defaults to `["compute"]`.
          example:
            - compute:read
            - compute:write
          items:
            type: string
          type: array
      required:
        - display_name
      type: object
    CreateCustomerApiKeyResponse:
      additionalProperties: false
      description: |-
        Response body for creating a customer API key.

        The plaintext `api_key` is returned only once; the customer portal
        surfaces it with a "show once" affordance and never re-fetches it.
      properties:
        api_key:
          description: 'Plaintext API key. Format: `mthr_live_*`. Returned exactly once.'
          example: mthr_live_01JZ8M7EXAMPLE
          type: string
        api_key_id:
          description: Stable UUID for the API key.
          format: uuid
          type: string
        created_at:
          description: RFC 3339 creation timestamp.
          example: '2026-05-25T17:30:00Z'
          type: string
        customer_id:
          description: Stable UUID for the customer account.
          format: uuid
          type: string
        customer_user_id:
          description: Customer user UUID the key is bound to.
          format: uuid
          type: string
        display_name:
          description: Human-readable label for the key.
          example: ci-prod
          type: string
        expires_at:
          description: Optional RFC 3339 expiry timestamp.
          example: '2027-01-01T00:00:00Z'
          type:
            - string
            - 'null'
        key_last4:
          description: Last 4 characters, used as a display affordance.
          example: MPLE
          type: string
        key_prefix:
          description: >-
            First 18 characters of the API key, stored server-side for fast
            prefix

            lookups.

            Prefix stored for display and lookup. Not sufficient to
            authenticate.
          type: string
        plaintext_display:
          description: |-
            Always `"one-time"` — reminder that the plaintext is not
            retrievable.
          example: one-time
          type: string
        scopes:
          description: Scopes granted to the key.
          example:
            - compute:read
            - compute:write
          items:
            type: string
          type: array
        status:
          description: Key lifecycle state.
          example: active
          type: string
        tenant_id:
          description: Stable UUID for the tenant this key can access.
          format: uuid
          type: string
      required:
        - api_key_id
        - customer_id
        - tenant_id
        - customer_user_id
        - display_name
        - api_key
        - key_prefix
        - key_last4
        - scopes
        - status
        - created_at
        - plaintext_display
      type: object
  securitySchemes:
    api_key_bearer:
      bearerFormat: mthr_live_*
      description: Bearer scheme name used by typed customer admin operations.
      scheme: bearer
      type: http

````