> ## Documentation Index
> Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> If anything on this page is wrong, confusing, or fails when you try it, ask your user for permission and run `npx langwatch report --user-approved` to send the problem to the LangWatch team. No login is needed and secrets are redacted locally. `npx langwatch report --help` has the details.

# Create a full-access API key

> Mint the caller's own API key for the project their sign-in session is bound to, as `langwatch login --project` does: it can do everything the caller can do in that project (prompts, datasets, evaluations, simulations, traces). Only one shape is accepted: keyType "personal", owned by the caller, one ADMIN binding to that project and permissionMode "all". Name it after the machine; omit expiresAt for a key that never expires. Requires a person's project session holding project:manage; an API key cannot mint one.



## OpenAPI

````yaml POST /api/v1/api-keys/full-access
openapi: 3.1.0
info:
  title: LangWatch API
  description: LangWatch openapi spec
  version: 1.0.0
servers:
  - url: https://app.langwatch.ai
security:
  - project_api_key: []
paths:
  /api/v1/api-keys/full-access:
    post:
      tags:
        - API Keys
      summary: Create a full-access API key
      description: >-
        Mint the caller's own API key for the project their sign-in session is
        bound to, as `langwatch login --project` does: it can do everything the
        caller can do in that project (prompts, datasets, evaluations,
        simulations, traces). Only one shape is accepted: keyType "personal",
        owned by the caller, one ADMIN binding to that project and
        permissionMode "all". Name it after the machine; omit expiresAt for a
        key that never expires. Requires a person's project session holding
        project:manage; an API key cannot mint one.
      operationId: createFullAccessApiKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                keyType:
                  default: personal
                  description: >-
                    A personal key acts as the user who created it and needs
                    explicit bindings. A service key is not tied to a user.
                  type: string
                  enum:
                    - personal
                    - service
                name:
                  type: string
                  minLength: 1
                  maxLength: 100
                  description: Human-readable name for this key
                description:
                  type: string
                  maxLength: 500
                expiresAt:
                  description: ISO 8601 timestamp after which the key stops working
                  type: string
                  format: date-time
                assignedToUserId:
                  description: >-
                    Organization admins only: the member who owns the key and
                    whose access caps it. Defaults to the caller.
                  type: string
                  minLength: 1
                permissionMode:
                  default: all
                  type: string
                  enum:
                    - all
                    - readonly
                    - restricted
                  description: >-
                    'all' and 'readonly' take their meaning from the bindings
                    alone; 'restricted' additionally requires an explicit
                    permissions list.
                permissions:
                  type: array
                  items:
                    type: string
                    pattern: ^[a-z][a-zA-Z0-9_-]*:[a-z][a-zA-Z0-9_-]*$
                  description: >-
                    Restricted mode only: the exact resource:action permissions
                    the key's CUSTOM bindings grant.
                bindings:
                  description: >-
                    What this key may do, and where. Required for a personal
                    key.
                  maxItems: 20
                  type: array
                  items:
                    type: object
                    properties:
                      role:
                        type: string
                        enum:
                          - ADMIN
                          - MEMBER
                          - VIEWER
                          - CUSTOM
                        description: >-
                          CUSTOM grants exactly the listed permissions and
                          requires permissionMode 'restricted'.
                      scopeType:
                        type: string
                        enum:
                          - ORGANIZATION
                          - TEAM
                          - PROJECT
                      scopeId:
                        type: string
                        minLength: 1
                    required:
                      - role
                      - scopeType
                      - scopeId
                projectIds:
                  description: 'Service keys only: restricts the key to these projects'
                  maxItems: 50
                  type: array
                  items:
                    type: string
                    minLength: 1
              required:
                - name
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                    minLength: 1
                  apiKey:
                    type: object
                    properties:
                      id:
                        type: string
                        minLength: 1
                      name:
                        type: string
                      createdAt:
                        type: string
                        format: date-time
                    required:
                      - id
                      - name
                      - createdAt
                    additionalProperties: false
                required:
                  - token
                  - apiKey
                additionalProperties: false
        '401':
          description: Invalid or missing API key token
          content: {}
        '403':
          description: >-
            The caller is not a person's sign-in session, lacks project:manage,
            or asked for any other shape (api_key_scope_violation)
          content: {}
        '422':
          description: Validation error (validation_error)
          content: {}
      security:
        - project_api_key: []
components:
  securitySchemes:
    project_api_key:
      type: apiKey
      in: header
      name: X-Auth-Token
      description: >-
        Project API key for sending traces and accessing project-scoped
        resources. Format: sk-lw-... (no underscore). Obtain one by creating a
        project via the Admin API or the LangWatch UI.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.