Skip to main content
POST
/
v1
/
api-keys
Create API Key
curl --request POST \
  --url https://api.example.com/v1/api-keys \
  --header 'Content-Type: application/json' \
  --data '
{
  "expiration_days": 123
}
'
{
  "id": "<string>",
  "organization_id": "<string>",
  "decrypted_key": "<string>",
  "created_at": "<string>",
  "modified_at": "<string>",
  "expiration_date": "<string>",
  "last_used_date": "<string>",
  "created_by_email": "<string>",
  "modified_by_email": "<string>"
}

​
Overview

Create a new API key for the authenticated user. The key is returned only once in the response - store it securely. Security:
  • API keys are encrypted before storage
  • Keys expire after 90 days by default (configurable up to 365 days)
  • Track last usage and expiration dates
  • Audit logs record all key creation events

​
Request Body

​
expiration_days
integer
default:90
Number of days until the API key expires
  • Minimum: 1 day
  • Maximum: 365 days
  • Default: 90 days

​
Response

​
id
string
required
Unique UUID identifier of the API key
​
organization_id
string
required
UUID of the organization this key belongs to
​
decrypted_key
string
required
The actual API key value. Only returned once during creation. Store this securely.Use this key in the Authorization: Bearer <key> header for API requests.
​
created_at
string
required
When the key was created (ISO 8601)
​
modified_at
string
required
When the key was last modified (ISO 8601)
​
expiration_date
string
required
When the key will expire (ISO 8601)
​
last_used_date
string
When the key was last used (ISO 8601). null for newly created keys.
​
created_by_email
string
Email address of the user who created the key
​
modified_by_email
string
Email address of the user who last modified the key

​
Example Request

curl -X POST https://api.airweave.ai/v1/api-keys \
  -H "Authorization: Bearer YOUR_CURRENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "expiration_days": 90
  }'

​
Example Response

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "organization_id": "770e8400-e29b-41d4-a716-446655440001",
  "decrypted_key": "awv_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
  "created_at": "2024-03-15T10:00:00Z",
  "modified_at": "2024-03-15T10:00:00Z",
  "expiration_date": "2024-06-13T10:00:00Z",
  "last_used_date": null,
  "created_by_email": "[email protected]",
  "modified_by_email": "[email protected]"
}

​
Best Practices

  • Store keys securely: Never commit API keys to version control
  • Rotate regularly: Use the rotate endpoint to refresh keys before expiration
  • Monitor usage: Check last_used_date to identify unused keys
  • Delete unused keys: Remove keys that are no longer needed
  • Set appropriate expiration: Use shorter expiration periods for production keys

​
Error Responses

​
400 Bad Request
Invalid expiration_days value (must be 1-365)
​
401 Unauthorized
Missing or invalid authentication

Build docs developers (and LLMs) love

Get started for freeTalk to us