> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a new API key > Mints an opaque `sk-orq-` API key. Use `project_scope` to bind it to a single project and `permission_mode` with `access` to restrict permissions. A management key with API-key write access can create keys. The legacy `projects` field is also accepted. The raw token is returned once in the `token` field and is never retrievable afterwards. Unknown body fields are rejected. > [!NOTE] > > **Related guide**: API keys guide. See the API keys guide for a walkthrough with examples. ## OpenAPI ````yaml post /v2/api-keys openapi: 3.1.0 info: title: Toqan Router API version: '2.0' description: Toqan Router API documentation servers: - url: https://router.toqan.ai/eu description: Frankfurt (Europe) - url: https://router.toqan.ai/br description: São Paulo (Brazil) security: - ApiKey: [] tags: - description: >- API keys authenticate programmatic access to the workspace. They expose opaque tokens, per-domain access grants, and budget and rate-limit constraints. name: API keys - name: Logs description: >- OpenTelemetry log query API. Search, filter, aggregate, and facet log records ingested via OTLP. - name: Reporting description: >- GenAI reporting API over canonical analytics rollups. Accepts a metric name, time range, grain, group-by, and filters; returns a typed time series and optional totals. - name: Telemetry description: >- Unified query envelope for traces, metrics, and logs. One request shape, one filter dialect, and one response shape per source, validated by a per-source registry. - name: Traces description: >- Query and inspect ingested trace data: search trace summaries, aggregate metrics, and read individual traces and their spans. - name: Views description: Saved filters and columns for workspace observability pages. - description: List models available through the AI Router. name: Models - name: Alerts description: >- Alerts evaluate a telemetry metric on a fixed interval and fire notifications through notifiers when the value breaches a threshold. Each breach opens a trigger that tracks the incident until the value recovers. - name: Annotation Queues description: Annotation queues collect spans for human review. - name: Budgets description: >- Budgets govern spend, token usage, and request rate across six scopes: workspace, project, identity, API key, provider, and model. Every applicable budget is enforced, and the most restrictive limit applies per dimension. - name: Files description: File upload and retrieval operations. - name: Guardrail Rules description: >- Guardrail Rules conditionally enforce evaluators and plugins for AI Gateway traffic. Rules may be scoped to a project or the whole workspace. - name: Identities description: >- Identities represent end users from your system for usage and engagement tracking. - name: Management keys description: >- Management keys are workspace-scoped credentials that authenticate programmatic access to workspace administration surfaces (API keys, budgets). Unlike project-scoped API keys, a management key always operates at the workspace level. - name: MCP Gateway description: >- Register upstream MCP servers, discover and sync their tools, and assemble gateways that expose a curated tool surface to MCP clients. - name: Model Catalog description: >- Browse the Toqan Router model catalog: every model Toqan Router offers, across every provider, with pricing, capabilities and benchmark data. List endpoints only return models that are not deprecated. This API is public, requires no authentication, and is rate limited to 120 requests per minute per IP. Responses carry a 5-minute cache-control max-age. - name: Monitors description: >- Monitors are custom observability dashboards for traces, runtime metrics, and logs. Each monitor holds widgets that chart one telemetry query. List the metrics, operations, and dimensions available to your workspace with `GET /v3/telemetry/capabilities`, or start from a preset with `GET /v2/monitors/presets`. - name: Notifiers description: Notifier destinations used to send delivery and workflow notifications. - name: Routing Rules description: >- Routing Rules conditionally select models and enforce request plugins for AI Gateway traffic. Rules are evaluated by ascending priority and may be scoped to a project or the whole workspace. - name: Threads description: Threads group related trace invocations and their aggregate usage - name: Smart Routers description: >- Create and manage workspace Smart Routers. A Smart Router selects a model from an eligible pool for each request according to a quality, balanced, or cost profile. - name: Responses - name: Embeddings - description: Beta. Run typed classification questions against a classify model. name: Classify - description: Beta. Run classification decisions with the classify contract. name: Decisions - description: >- Run large offline workloads as JSONL batches and download OpenAI-compatible result files. name: Batches paths: /v2/api-keys: post: tags: - API keys summary: Create a new API key description: >- Mints an opaque `sk-orq-` API key. Use `project_scope` to bind it to a single project and `permission_mode` with `access` to restrict permissions. A management key with API-key write access can create keys. The legacy `projects` field is also accepted. The raw token is returned once in the `token` field and is never retrievable afterwards. Unknown body fields are rejected. operationId: ApiKeyCreate requestBody: content: application/json: schema: additionalProperties: false properties: access: additionalProperties: type: string description: >- Per-domain access level (none, read or write) for restricted keys; domain ids come from the capability catalog. type: object constraints: $ref: '#/components/schemas/Constraints' description: Expiry and other limits applied to the key. expiration: description: >- Legacy expiry as an RFC 3339 timestamp; prefer constraints.expires_at. format: date-time type: string name: description: Display name of the key. maxLength: 100 type: string owner: $ref: '#/components/schemas/Owner' description: >- Lifecycle binding: a user-owned key is revoked with the user, a service-account key outlives any user. permission_mode: description: >- Permission preset; restricted keys hold only the domains granted in access. enum: - all - restricted - read_only - PERMISSION_MODE_ALL - PERMISSION_MODE_RESTRICTED - PERMISSION_MODE_READ_ONLY type: string project_scope: $ref: '#/components/schemas/RequestProjectScope' description: >- Projects the key may reach: every project of the workspace or a single one. projects: description: Legacy single-project binding; prefer project_scope. items: type: string maxItems: 1 type: - array - 'null' required: - name type: object required: true responses: '200': description: API key created successfully. content: application/json: schema: $ref: '#/components/schemas/ApiKeyRestResponse' '400': description: Invalid or unknown body field '401': description: Missing or invalid credentials '403': description: >- The caller may not create API keys or the requested scope exceeds the caller's reach security: - ApiKey: [] x-code-samples: - lang: curl label: Core - Create service account key source: | curl --request POST \ --url 'https://router.toqan.ai/eu/v2/api-keys' \ --header "Authorization: Bearer $TOQAN_MANAGEMENT_KEY" \ --header 'Content-Type: application/json' \ --data '{ "name": "Production service key", "owner": { "type": "service_account" }, "project_scope": { "mode": "all" }, "permission_mode": "all" }' - lang: curl label: Core - Create restricted project key source: | curl --request POST \ --url 'https://router.toqan.ai/eu/v2/api-keys' \ --header "Authorization: Bearer $TOQAN_MANAGEMENT_KEY" \ --header 'Content-Type: application/json' \ --data '{ "name": "Support automation key", "project_scope": { "mode": "single", "project_id": "proj_01HZXW2K7Y8Q9M0N1P2R3S4T5V" }, "permission_mode": "restricted", "access": { "agent": "write", "deployment": "read" } }' components: schemas: Constraints: additionalProperties: false properties: expires_at: type: string format: date-time type: object Owner: additionalProperties: false properties: type: type: string user_id: type: string required: - type type: object RequestProjectScope: additionalProperties: false properties: all: $ref: '#/components/schemas/AllProjectsScope' mode: enum: - all - single - PROJECT_SCOPE_MODE_ALL - PROJECT_SCOPE_MODE_SINGLE type: string project_id: type: string single: $ref: '#/components/schemas/SingleProjectScope' type: object ApiKeyRestResponse: type: object required: - id - name - workspace_id - token additionalProperties: true properties: id: type: string name: type: string workspace_id: type: string token: type: string description: >- Raw on create; the key prefix on retrieve and update; masked in list responses. active: type: boolean is_legacy: type: boolean source: type: string budget: type: object additionalProperties: true expiration: type: string format: date-time projects: type: array items: type: string created_by_id: type: string nullable: true updated_by_id: type: string nullable: true created: type: string format: date-time updated: type: string format: date-time consumption: type: number token_consumption: type: number requests_per_minute_consumption: type: number owner: type: object additionalProperties: true project_scope: type: object additionalProperties: true permission_mode: type: string access: type: object additionalProperties: type: string token_prefix: type: string status: type: string constraints: type: object additionalProperties: true mcp_access: type: object additionalProperties: true legacy_token_family: type: string legacy_key_id: type: string last_used_at: type: string format: date-time AllProjectsScope: additionalProperties: false type: object SingleProjectScope: additionalProperties: false properties: project_id: type: string required: - project_id type: object securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.