# Create API Key

`POST https://api.astroway.info/v1/keys`

Create a new API key. Requires an internal or enterprise API key. Returns the generated key string: save it, it cannot be retrieved later. The plan comes from the account and is not accepted in the body. allowed_endpoints limits the key to a subset of the API: paths under /v1, exact ("chart") or a namespace ("embed/*"); omit it and the key may call everything the plan includes. credits_cap_cycle caps what this key may spend per billing cycle (0 parks it). A publishable key (origin_restriction.type "public", prefix pk_) is for page source, so it needs allowed_origins, credits_cap_cycle and allowed_endpoints: without any of them the request is refused with 400, and a pk_ key missing a bound is refused with 403 PUBLISHABLE_KEY_UNBOUNDED wherever it is used.

Group: System. Auth: `X-Api-Key` header. Operation ID: `keys`.

## Parameters

| Name | In | Required | Type | Description |
|---|---|---|---|---|
| `fields` | query | no | string | Comma-separated dotted paths, relative to `data`, to keep in the response. A path is applied to every element of an array, so `planets.name` means the name of each planet. Paths that match nothing come back in `_fields_unmatched`; a list where nothing matches at all is a 400, because an empty object would be a confident wrong answer. |
| `precision` | query | no | integer | Round every non-integer number in the response to this many decimal places. Integers are left alone, because an id is not a measurement. Ecliptic longitudes ship with fourteen decimals by default; 2 is about a tenth of an arcminute. |

## Request body

| Field | Type | Required | Description |
|---|---|---|---|
| `name` | string | yes |  |
| `mode` | "live" \| "test" | no |  |
| `origin_restriction` | object | no | server-only (default): a backend key that refuses any request carrying Origin or Referer. public: a publishable pk_ key for page source; needs allowed_origins, credits_cap_cycle and allowed_endpoints, and refuses a request with no verifiable origin. |
| `origin_restriction.type` | "server-only" \| "public" | no |  |
| `origin_restriction.allowed_origins` | string[] | no |  |
| `allowed_endpoints` | string[] | no | Paths under /v1 this key may call, exact (chart) or a namespace (embed/*). Omitted means no limit; required for a publishable key. |
| `credits_cap_cycle` | integer | no | Credits this key may spend per billing cycle; 0 parks it. Omitted means no per-key cap; required for a publishable key. |

```json
{
  "name": "My App",
  "mode": "live",
  "allowed_endpoints": [
    "chart",
    "embed/*"
  ],
  "credits_cap_cycle": 20000
}
```

## Responses

| Status | Meaning |
|---|---|
| 200 | Successful calculation |
| 400 | Validation error |
| 401 | Missing or invalid API key |

### Success fields, under `data`

| Field | Type | Required | Description |
|---|---|---|---|
| `id` | number | no |  |
| `api_key` | string | no |  |
| `api_key_masked` | string | no |  |
| `name` | string | no |  |
| `plan` | string | no |  |
| `rate_limit` | number | no |  |
| `credits_limit` | number | no |  |
| `credits_used` | number | no |  |
| `created_at` | string | no |  |
| `last_used_at` | object | no |  |
| `is_active` | boolean | no |  |
| `origin_restriction` | object | no |  |
| `origin_restriction.type` | string | no |  |
| `credits_cap_cycle` | number | no |  |
| `allowed_endpoints` | string[] | no |  |

## Example

```bash
curl -X POST https://api.astroway.info/v1/keys \
  -H "X-Api-Key: aw_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "name": "My App", "mode": "live", "allowed_endpoints": [ "chart", "embed/*" ], "credits_cap_cycle": 20000 }'
```

---

Rendered from https://api.astroway.info/v1/openapi.json. HTML page: https://api.astroway.info/docs/api/operations/keys/