> ## Documentation Index
> Fetch the complete documentation index at: https://dialnexa.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API Key

> Generate a new API key for programmatic access to DialNexa. The secret is returned only once at creation.

<Warning>
  **Legacy endpoint - deprecated.** Unversioned endpoints are scheduled for removal on **July 31, 2026**. A public v1 replacement is not currently listed in the v1 reference. This endpoint remains available for existing integrations until then.
</Warning>

Generates a new API key. The secret value is returned **only once**: in the response of this call. DialNexa does not store the secret in a recoverable form, so if you lose it you must revoke the key with [Revoke API Key](/docs/api-reference/api-keys/revoke) and create a new one. Keys are scoped to the workspace they are created in and inherit the permissions of the caller that created them.

## When to use this

* **First-time setup**: issue the initial key for a new environment.
* **New consumer service**: issue a dedicated key for each upstream service so you can revoke them independently if needed.
* **Planned rotation**: issue the next key as the first step in the [Key rotation](/docs/api-access/key-rotation) playbook.
* **Environment separation**: keep production, staging, and development keys distinct so a leak in one environment does not compromise the others.

## Best practices

* **One key per environment.** Create separate keys for development, staging, and production so revocation never takes down more than one environment at a time.
* **One key per consumer service.** If multiple services share a key, a leak forces you to rotate every consumer at once. Per-service keys narrow the blast radius.
* **Never commit keys to source control.** Use environment variables or a secrets manager. Keys accidentally pushed to a public repository should be revoked immediately, even if you delete the commit.
* **Rotate periodically.** Issue a new key, deploy it everywhere it is needed, verify traffic on the new key through [List API Keys](/docs/api-reference/api-keys/list)' `last_used_at` field, then revoke the old one.

## Authentication

Use the returned secret as a Bearer token in the `Authorization` header on every API request:

```bash theme={null}
curl https://api.dialnexa.com/v1/agents \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Errors

* `400 Bad Request` is returned when the `name` field is missing or empty.
* `403 Forbidden` is returned when the caller does not have permission to create API keys.

## Related endpoints

* [List API Keys](/docs/api-reference/api-keys/list): review every key on the workspace.
* [Rename API Key](/docs/api-reference/api-keys/update): change a key's display name.
* [Revoke API Key](/docs/api-reference/api-keys/revoke): permanently retire a key.
* [Key rotation](/docs/api-access/key-rotation): recommended sequence for rotating keys without downtime.
* [Authentication](/docs/api-reference/authentication): how keys are sent and verified.


## OpenAPI

````yaml POST /api-keys
openapi: 3.0.0
info:
  title: DialNexa API
  description: >-
    Public REST API for the DialNexa voice AI platform. Versioned endpoints are
    under /v1; unversioned endpoints are legacy and deprecated.
  version: 1.0.0
servers:
  - url: https://api.dialnexa.com
    description: DialNexa production API
security:
  - bearer: []
tags:
  - name: API Keys
  - name: Agent Functions
  - name: Agents V1
  - name: Agents2
  - name: Batch Calls
  - name: Batch Calls V1
  - name: Call Logs
  - name: Calls
  - name: Calls V1
  - name: Campaign Leads
  - name: Campaigns
  - name: External Webhooks
  - name: Knowledge Base
  - name: Knowledge Base V1
  - name: LLMs
  - name: LLMs V1
  - name: Languages
  - name: Languages V1
  - name: Organization Phone Numbers
  - name: Organization Phone Numbers V1
  - name: Phone Number Pricing
  - name: Phone Number Pricing V1
  - name: Transcribers
  - name: Transcribers V1
  - name: User Webhooks
  - name: User Webhooks V1
  - name: V1
  - name: Voices
  - name: Voices V1
  - name: Webcall
  - name: Workflow Leads
  - name: Workflow Leads V1
  - name: Workflows
  - name: Workflows V1
paths:
  /api-keys:
    post:
      tags:
        - API Keys
      summary: Create a new API key for an organization
      description: >-
        **Legacy endpoint - deprecated, scheduled for removal on July 31,
        2026.** Use the `/v1` version for new integrations. 
      operationId: ApiKeyController_createApiKey
      parameters:
        - name: x-organization-id
          in: header
          description: RSA encrypted organization ID (base64 format)
          required: true
          schema:
            type: string
            example: BASE64_ENCRYPTED_ORG_ID_HERE
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyDto'
      responses:
        '201':
          description: API key created
          content:
            application/json:
              schema:
                example:
                  statusCode: 201
                  message: API key created successfully
                  data:
                    rawKey: b7f9e3b0c44298fc1c149afbf4c8996f
                    apiKey:
                      id: 1
                      organization_id: 123
                      key: e3b0c44298fc1c149afbf4c8996fb924
                      name: Docs Key
                      last_used_at: '2024-06-10T12:00:00.000Z'
                      created_at: '2024-06-10T11:00:00.000Z'
                      updated_at: '2024-06-10T11:00:00.000Z'
      deprecated: true
      security:
        - bearer: []
components:
  schemas:
    CreateApiKeyDto:
      type: object
      properties:
        name:
          type: string
          example: Docs Key
          description: Label for the API key
        expire_now:
          type: boolean
          example: false
          description: Expire previous key immediately if true, else in 24 hours
      required:
        - name
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````