> ## Documentation Index > Fetch the complete documentation index at: https://docs.gateway.connexease.com/llms.txt > Use this file to discover all available pages before exploring further. # Create API Key > Creates a new API key for an application. **The key value is returned exactly once, in this response.** Later reads expose the key's metadata (name, expiry, status) but never the secret again. Store it in your secret manager the moment you receive it; if it is lost, the only remedy is to create a new key. **Rotation.** Set an expiry even for long-lived keys, and rotate before it lands: create the new key, deploy it, then let the old one expire. A rotation then never needs a window where no valid key exists. ## OpenAPI ````yaml /public-openapi.json post /apps/{app_id}/api-keys openapi: 3.0.3 info: title: Connexease Public API version: 1.0.0 description: >- Panel-independent API for managing WhatsApp Business operations from your own servers. Every endpoint is scoped to the organization resolved from your secret key. Read endpoints are uncached and proxy straight to the source. **On-premises installations** are served from your own domain with an extra `/public` segment: `https://{your_domain}/public/api/v1/...`. Authentication, bodies, responses, and error codes are identical. servers: - url: https://public-api.gateway.connexease.com/api/v1 description: Production security: - secretKey: [] tags: - name: Analytics description: Organization-wide message volume. - name: Application description: The WhatsApp business profile linked to an application. - name: Template description: >- The full template lifecycle: create, list, inspect, update, delete, and measure. - name: Media description: >- Uploads that produce the single-use handle for template headers and the profile picture. - name: Developers description: Webhook configuration and API keys. paths: /apps/{app_id}/api-keys: post: tags: - Developers summary: Create API Key description: >- Creates a new API key for an application. **The key value is returned exactly once, in this response.** Later reads expose the key's metadata (name, expiry, status) but never the secret again. Store it in your secret manager the moment you receive it; if it is lost, the only remedy is to create a new key. **Rotation.** Set an expiry even for long-lived keys, and rotate before it lands: create the new key, deploy it, then let the old one expire. A rotation then never needs a window where no valid key exists. operationId: createApiKey parameters: - $ref: '#/components/parameters/AppId' requestBody: required: true content: application/json: schema: type: object required: - name properties: name: type: string description: >- A label for the key. Use something that identifies where it is deployed (`prod-backend`, `ci-pipeline`) — it is how you will recognise the key later, since the value itself is not visible. expiresAt: type: string format: date-time description: >- ISO-8601 timestamp at which the key stops working. Must be in the future. example: name: prod-backend expiresAt: '2027-08-20T13:27:30.368Z' responses: '200': description: The created key, including its one-time value. content: application/json: schema: type: object properties: data: type: object properties: id: type: string format: uuid description: UUID of the key record. appId: type: string name: type: string key: type: string description: >- The key value — returned only in this response, never retrievable afterwards. isActive: type: boolean expiresAt: type: string format: date-time createdAt: type: string format: date-time isSuccess: type: boolean enum: - true example: data: id: 47fee6cf-9634-47b2-882f-4e9b90e57158 appId: app_7poyXj8GXuv76e name: prod-backend key: isActive: true expiresAt: '2027-08-20T13:27:30.368000Z' createdAt: '2026-08-20T13:33:15.985914Z' isSuccess: true '400': $ref: '#/components/responses/MalformedRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/AppNotFound' '422': $ref: '#/components/responses/ValidationFailed' components: parameters: AppId: name: app_id in: path required: true description: >- Application ID. Must belong to the organization resolved from your secret key, otherwise the request returns `404` with `APPLICATION_004`. schema: type: string example: app_7poyXj8GXuv76e responses: MalformedRequest: description: >- Missing required field, unparseable number or UUID, or invalid JSON (`REQ_001`). Not a field-validation error — no `fields` map is returned, because the request could not be read well enough to validate it. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' Unauthorized: description: >- Secret key missing (`ORGANIZATION_SECRET_010`) or invalid (`ORGANIZATION_SECRET_011`). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' AppNotFound: description: '`app_id` does not belong to the organization (`APPLICATION_004`).' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' ValidationFailed: description: >- Field validation failed. Top-level code is `VAL_000`; each offending field is listed under `errors.fields`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' schemas: ErrorEnvelope: type: object description: >- Every failure shares this shape. `description` already has any `params` interpolated into it. properties: isSuccess: type: boolean enum: - false errors: type: object properties: code: type: string description: >- `VAL_*`, `WA_*`, `META_*`, `APPLICATION_*`, `ORGANIZATION_SECRET_*`, `REQ_001`, or `SYS_001`. example: META_075 group: type: string enum: - VALIDATION - NOT_FOUND - CONFLICT - AUTHENTICATION - NOT_ALLOWED - LIMIT_EXCEEDED - SERVICE_UNAVAILABLE - SYSTEM description: type: string example: Template with 0000000000 not found in Meta. params: type: object additionalProperties: true description: >- Raw values interpolated into `description`. Present only on parametric messages. fields: type: object description: >- Field-level validation errors only. Field name (dot-joined for nested fields, list indices omitted) to its own `code` / `description` / `params`. additionalProperties: type: object properties: code: type: string description: type: string params: type: object additionalProperties: true required: - code - group - description required: - isSuccess - errors securitySchemes: secretKey: type: http scheme: bearer description: >- Secret key in `Bearer sk_...` format. Server-to-server only — never embed it in a browser or mobile client. The organization is resolved from the key, so `organization_id` is never passed explicitly. ````