---
title: Create a live workspace API key
description: "Session-only — a bearer cannot mint another bearer (privilege-escalation surface), so any wbl_* is rejected with INSUFFICIENT_PRIVILEGE."
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/api-keys"
canonical_url: https://wiblo.app/docs/developers/api/api-keys/create-api-key
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/api-keys/create-api-key.md
---

# Create a live workspace API key

`POST /v1/workspaces/{workspaceId}/api-keys`

Session-only — a bearer cannot mint another bearer (privilege-escalation surface), so any `wbl_*` is rejected with `INSUFFICIENT_PRIVILEGE`. Creates a `live` key under the named integration (machine member), creating the machine member if the name is new. `role_cap` must not exceed the caller's effective role. The raw `access_key` is returned exactly once. Per-workspace rate-limited at 10 mints / 10 minutes.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `integration_name` | `string` | Yes |  |
| `role_cap` | `"admin" \| "member"` | Yes |  |
| `expires_at` | `string \| null` | No | Defaults to `null`. |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/api-keys \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "integration_name": "...",
  "role_cap": "admin"
}'
```

**TypeScript**

```ts
import { createSdk, createApiKey } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await createApiKey({
  client: sdk,
  path: { workspaceId: "..." },
  body: {
    "integration_name": "...",
    "role_cap": "admin"
  },
})
```

## Responses

**`201`** — The key was created; `access_key` is shown once. Returns `CreateApiKeyResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `access_key` | `string` | Yes |  |
| `id` | `string` | Yes |  |
| `member_id` | `string` | Yes |  |
| `key_prefix` | `string` | Yes |  |
| `role_cap` | `"admin" \| "member"` | Yes |  |
| `kind` | `"live"` | Yes |  |
| `expires_at` | `string \| null` | Yes |  |

**`400`** — Body failed Zod validation (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — A `wbl_*` bearer was presented (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — Caller has no active membership in the workspace, or it does not exist (`WORKSPACE_NOT_FOUND`). Returns `ApiErrorEnvelope`.

**`409`** — Another active integration in the workspace already uses this name (`MACHINE_MEMBER_NAME_TAKEN`). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`) or `role_cap` exceeds the caller's effective role (`ROLE_CAP_EXCEEDED`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.