Skip to main content
POST
Create an API key

Authorizations

Authorization
string
header
required

Admin API key for organization-level operations (managing projects, API keys). Create one in Settings > API Keys or via POST /api/api-keys. Format: sk-lw-{id}_{secret}.

Body

application/json
name
string
required

Human-readable name for this key

Required string length: 1 - 100
keyType
enum<string>
default:personal

A personal key acts as the user who created it and needs explicit bindings. A service key is not tied to a user.

Available options:
personal,
service
description
string
Maximum string length: 500
expiresAt
string

ISO 8601 timestamp after which the key stops working

assignedToUserId
string

Organization admins only: the member who owns the key and whose access caps it. Defaults to the caller.

Minimum string length: 1
permissionMode
enum<string>
default:all

'all' and 'readonly' take their meaning from the bindings alone; 'restricted' additionally requires an explicit permissions list.

Available options:
all,
readonly,
restricted
permissions
string[]

Restricted mode only: the exact resource:action permissions the key's CUSTOM bindings grant.

bindings
object[]

What this key may do, and where. Required for a personal key.

Maximum array length: 20
projectIds
string[]

Service keys only: restricts the key to these projects

Maximum array length: 50
Minimum string length: 1

Response

API key created. The token field contains the plaintext key — it is only shown once.

token
string

Plaintext API key token (sk-lw-...). Store securely — shown only once.

apiKey
object
Last modified on May 13, 2026