# Create a workspace API key
POST /api/api-keys
Creates a programmatic bearer token. The `token` is returned once and Sourced stores only a hash.
## Request
```bash
curl -X POST 'https://sourced.sh/api/api-keys' \
  -H 'Authorization: Bearer $SOURCED_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'
```
## Request body

ApiKeyCreateInput:
  type: object
  properties:
    name: string
    scopes: array
      Optional API key scopes. When omitted, Sourced creates a narrow key with `workspace:read`, `projects:write`, `runs:write`, and `artifacts:read`. Enforced public scopes include `workspace:read`, `projects:write`, `runs:write`, `artifacts:read`, `artifacts:write`, `api_keys:read`, `api_keys:write`, `billing:write`, `notifications:read`, `notifications:write`, `domains:read`, `domains:write`, `members:read`, `members:write`, `publishing:dry_run`, and `publishing:write`.
      type: array
      description: Optional API key scopes. When omitted, Sourced creates a narrow key with `workspace:read`, `projects:write`, `runs:write`, and `artifacts:read`. Enforced public scopes include `workspace:read`, `projects:write`, `runs:write`, `artifacts:read`, `artifacts:write`, `api_keys:read`, `api_keys:write`, `billing:write`, `notifications:read`, `notifications:write`, `domains:read`, `domains:write`, `members:read`, `members:write`, `publishing:dry_run`, and `publishing:write`.

## Responses

### 201

API key created.
### 401


### 403