Skip to main content
POST
Create a new API key
This endpoint requires a management API key. Standard Gateway API keys are not accepted.
The plaintext API key is returned once at creation time. The compatibility fields limit, limit_reset, and include_byok_in_limit are accepted; Phaseo currently treats include_byok_in_limit as compatibility-only and always excludes BYOK from this key limit field.

Authorizations

Authorization
string
header
required

Bearer token authentication

Body

application/json
name
string
required
Minimum string length: 1
Example:

"Analytics Service Key"

workspace_id
string<uuid>

Optional workspace override for internal callers.

scopes
Example:

"[\"chat.completions\",\"responses\"]"

limit
number | null

Optional spend limit in USD for this key.

Required range: x >= 0
limit_reset
enum<string>

Period used for the spend limit window.

Available options:
daily,
weekly,
monthly
include_byok_in_limit
boolean

Accepted for compatibility. Current Phaseo behavior always excludes BYOK from this limit field.

expires_at
string<date-time> | null
disabled
boolean
default:false
soft_blocked
boolean
default:false
limits
object
department_id
string<uuid> | null

Department this key belongs to for department rate limits and budgets. Null means the key counts only toward workspace-wide limits.

storage_locations
string[]

Where you keep this key, such as the hosting platform whose environment variables hold it. Optional. If one of these places reports a breach, you can find and revoke every key stored there. Known ids: railway, vercel, netlify, render, fly, heroku, cloudflare, supabase, firebase, digitalocean, replit, modal, convex, koyeb, coolify, northflank, expo, deno-deploy, aws, google-cloud, azure, hetzner, vultr, linode, ovhcloud, scaleway, kubernetes, github, gitlab, circleci, bitbucket, 1password, bitwarden, hashicorp-vault, doppler, infisical, local-machine, own-server, other.

Maximum array length: 8
Pattern: ^[a-z0-9][a-z0-9-]{0,39}$
Example:

Response

API key created

key
string
required

Plaintext API key, the same value as data.key. Returned only once, at creation time.

Example:

"phaseo_v1_sk_abcd1234_supersecretvalue"

data
object
required
Last modified on October 18, 2026