# Create API key

POST https://api.cash.app/management/v1/api-keys
Content-Type: application/json

Creates a new API key and secret to use in the `Authorization` and `X-Signature` headers for requests to the Cash App Pay API. This key will automatically expire at the date and time specified in the `expires_at` field in the response payload.

<Note title="Note">
 The `secret` returned in the response payload is what you use to calculate the `X-Signature` header. The API key ID is only used to keep track of which API keys are active, and isn't considered secret.
 Keep in mind that the `secret` can never be retrieved in subsequent requests to the API, so make sure to store it immediately!
</Note>
**This endpoint is rate limited to 5 QPS.**

Scopes: `API_KEYS_WRITE`

Reference: https://developers.cash.app/cash-app-pay-partner-api/api-reference/management-api/create-api-key

## OpenAPI Specification

```yaml
openapi: 3.1.1
info:
  title: Create API key
  version: endpoint_apiKeys.create-api-key
paths:
  /api-keys:
    post:
      operationId: create-api-key
      summary: Create API key
      description: >-
        Creates a new API key and secret to use in the `Authorization` and
        `X-Signature` headers for requests to the Cash App Pay API. This key
        will automatically expire at the date and time specified in the
        `expires_at` field in the response payload.


        <Note title="Note">
         The `secret` returned in the response payload is what you use to calculate the `X-Signature` header. The API key ID is only used to keep track of which API keys are active, and isn't considered secret.
         Keep in mind that the `secret` can never be retrieved in subsequent requests to the API, so make sure to store it immediately!
        </Note>

        **This endpoint is rate limited to 5 QPS.**


        Scopes: `API_KEYS_WRITE`
      tags:
        - - subpackage_apiKeys
      parameters:
        - name: Accept
          in: header
          required: true
          schema:
            type: string
        - name: X-Region
          in: header
          required: true
          schema:
            type: string
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
        - name: User-Agent
          in: header
          required: true
          schema:
            type: string
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/apiKeys_create-api-key_Response_201'
        '400':
          description: Bad Request
          content: {}
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              type: object
              properties:
                idempotency_key:
                  $ref: '#/components/schemas/IdempotencyKey'
                api_key:
                  $ref: >-
                    #/components/schemas/ApiKeysPostRequestBodyContentApplicationJsonSchemaApiKey
                  description: Details about the API key to create.
              required:
                - idempotency_key
                - api_key
components:
  schemas:
    IdempotencyKey:
      type: string
    ScopesItems:
      type: string
      enum:
        - value: PAYMENTS_READ
        - value: PAYMENTS_WRITE
        - value: REFUNDS_READ
        - value: REFUNDS_WRITE
        - value: DISPUTES_READ
        - value: DISPUTES_WRITE
        - value: CUSTOMERS_READ
        - value: FEE_PLANS_READ
        - value: GRANTS_READ
        - value: GRANTS_WRITE
        - value: API_KEYS_READ
        - value: API_KEYS_WRITE
        - value: BRANDS_READ
        - value: BRANDS_WRITE
        - value: MERCHANTS_READ
        - value: MERCHANTS_WRITE
        - value: WEBHOOK_CONFIG_READ
        - value: WEBHOOK_CONFIG_WRITE
        - value: WEBHOOK_EVENTS_READ
    Scopes:
      type: array
      items:
        $ref: '#/components/schemas/ScopesItems'
    ApiKeysPostRequestBodyContentApplicationJsonSchemaApiKey:
      type: object
      properties:
        scopes:
          $ref: '#/components/schemas/Scopes'
        reference_id:
          type: string
          description: >-
            A user-defined identifier for this API key, typically used to
            associate the API key with a record in an external system.


            Min length: `1`

            Max length: `1024`
      required:
        - scopes
    ApiKey:
      type: object
      properties:
        id:
          type: string
          description: >-
            Unique identifier for this API key issued by Cash App. This is the
            API key value that is passed in the `Authorization` header.
        created_at:
          type: string
          format: date-time
          description: >-
            When this API key was created, in [RFC
            3339](https://datatracker.ietf.org/doc/html/rfc3339) format (UTC).
        expires_at:
          type: string
          format: date-time
          description: >-
            When this API key will be automatically deleted and become unusable,
            in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format
            (UTC).
        scopes:
          $ref: '#/components/schemas/Scopes'
        reference_id:
          type: string
          description: >-
            A user-defined identifier for this API key, typically used to
            associate the API key with a record in an external system.


            Min length: `1`

            Max length: `1024`
      required:
        - id
        - created_at
        - expires_at
        - scopes
    apiKeys_create-api-key_Response_201:
      type: object
      properties:
        api_key:
          $ref: '#/components/schemas/ApiKey'
        secret:
          type: string
          description: >-
            Secret value to use when calculating the `X-Signature` header of
            requests.


            This value is not returned when retrieving an API key, so make sure
            to store it immediately.


            Min length: `32`

            Max length: `256`
      required:
        - api_key
        - secret

```

## SDK Code Examples

```python
import requests

url = "https://api.cash.app/management/v1/api-keys"

payload = {
    "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
    "api_key": { "scopes": ["PAYMENTS_READ"] }
}
headers = {
    "Accept": "Accept",
    "X-Region": "X-Region",
    "X-Signature": "X-Signature",
    "User-Agent": "User-Agent",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.cash.app/management/v1/api-keys';
const options = {
  method: 'POST',
  headers: {
    Accept: 'Accept',
    'X-Region': 'X-Region',
    'X-Signature': 'X-Signature',
    'User-Agent': 'User-Agent',
    'Content-Type': 'application/json'
  },
  body: '{"idempotency_key":"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19","api_key":{"scopes":["PAYMENTS_READ"]}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cash.app/management/v1/api-keys"

	payload := strings.NewReader("{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Accept", "Accept")
	req.Header.Add("X-Region", "X-Region")
	req.Header.Add("X-Signature", "X-Signature")
	req.Header.Add("User-Agent", "User-Agent")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.cash.app/management/v1/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Accept"] = 'Accept'
request["X-Region"] = 'X-Region'
request["X-Signature"] = 'X-Signature'
request["User-Agent"] = 'User-Agent'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
HttpResponse<String> response = Unirest.post("https://api.cash.app/management/v1/api-keys")
  .header("Accept", "Accept")
  .header("X-Region", "X-Region")
  .header("X-Signature", "X-Signature")
  .header("User-Agent", "User-Agent")
  .header("Content-Type", "application/json")
  .body("{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}")
  .asString();
```

```php
<?php

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.cash.app/management/v1/api-keys', [
  'body' => '{
  "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
  "api_key": {
    "scopes": [
      "PAYMENTS_READ"
    ]
  }
}',
  'headers' => [
    'Accept' => 'Accept',
    'Content-Type' => 'application/json',
    'User-Agent' => 'User-Agent',
    'X-Region' => 'X-Region',
    'X-Signature' => 'X-Signature',
  ],
]);

echo $response->getBody();
```

```csharp
var client = new RestClient("https://api.cash.app/management/v1/api-keys");
var request = new RestRequest(Method.POST);
request.AddHeader("Accept", "Accept");
request.AddHeader("X-Region", "X-Region");
request.AddHeader("X-Signature", "X-Signature");
request.AddHeader("User-Agent", "User-Agent");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Accept": "Accept",
  "X-Region": "X-Region",
  "X-Signature": "X-Signature",
  "User-Agent": "User-Agent",
  "Content-Type": "application/json"
]
let parameters = [
  "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
  "api_key": ["scopes": ["PAYMENTS_READ"]]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.cash.app/management/v1/api-keys")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```