> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aion.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

> Creates a new API key for machine-to-machine authentication.

**Important:** The raw key value is only returned once in this response.
Store it securely as it cannot be retrieved again.

**Authentication**: Requires valid JWT. User can only create keys for themselves.




## OpenAPI

````yaml POST /api/v1/accounts/{account_id}/users/{user_id}/keys
openapi: 3.1.0
info:
  title: AION Authentication Service API
  description: >
    Authentication and user management service for the AION platform.


    This service provides:

    - JWT and API key validation

    - User profile management

    - API key lifecycle management

    - User invitation and team management


    ## Authentication


    Most endpoints require authentication via one of:

    - **Bearer Token (JWT)**: OAuth2/OIDC tokens from Auth0

    - **API Key**: Service-generated API keys for machine-to-machine
    authentication


    Protected endpoints also require the `x-account-id` header to specify the
    account context.


    ## Error Handling


    All errors follow a consistent format with error codes prefixed by category:

    - `AUTH_*`: Authentication errors

    - `USER_*`: User management errors

    - `ACCT_*`: Account errors

    - `ROLE_*`: Role/permission errors

    - `APIKEY_*`: API key errors

    - `GEN_*`: General errors
  version: 1.0.0
  contact:
    name: AION Intelligence
  license:
    name: Proprietary
servers:
  - url: http://localhost:9001
    description: Local development server (Public API)
  - url: http://localhost:9002
    description: Local development server (Private/Health endpoints - internal only)
  - url: https://api.aion.ai
    description: Production server (Public API)
  - url: https://api-internal.aion.ai
    description: Production server (Private/Health endpoints - internal network only)
security: []
tags:
  - name: Health
    description: >
      Service health and status endpoints.


      **IMPORTANT**: These endpoints are served on a separate private port (9002
      by default).

      They should NOT be exposed publicly and are intended for:

      - Kubernetes health probes (readiness/liveness)

      - Internal monitoring systems

      - Load balancer health checks
  - name: Authentication
    description: Authentication and credential validation
  - name: Webhooks
    description: Webhook endpoints for external services (Auth0)
  - name: User Profile
    description: User profile management
  - name: Users
    description: User management and invitations
  - name: API Keys
    description: API key lifecycle management
paths:
  /api/v1/accounts/{account_id}/users/{user_id}/keys:
    post:
      tags:
        - API Keys
      summary: Create API key
      description: >
        Creates a new API key for machine-to-machine authentication.


        **Important:** The raw key value is only returned once in this response.

        Store it securely as it cannot be retrieved again.


        **Authentication**: Requires valid JWT. User can only create keys for
        themselves.
      operationId: createAPIKey
      parameters:
        - $ref: '#/components/parameters/AccountId'
        - $ref: '#/components/parameters/UserId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAPIKeyRequest'
      responses:
        '201':
          description: API key created successfully
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    properties:
                      data:
                        $ref: '#/components/schemas/CreateAPIKeyResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Failed to create API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - bearerAuth: []
components:
  parameters:
    AccountId:
      name: account_id
      in: path
      required: true
      description: |
        Account's external ID (format: acct-xxx-v1)
      schema:
        type: string
        example: acct-xyz789-v1
    UserId:
      name: user_id
      in: path
      required: true
      description: |
        User's external ID (format: user-xxx-v1)
      schema:
        type: string
        example: user-abc123-v1
  schemas:
    CreateAPIKeyRequest:
      type: object
      required:
        - key_name
      properties:
        key_name:
          type: string
          description: Display name for the API key
          example: Production API Key
        scopes:
          type: array
          items:
            type: string
          description: Permission scopes for the key
          example:
            - read
            - write
    SuccessResponse:
      type: object
      properties:
        success:
          type: boolean
          example: true
        data:
          type: object
    CreateAPIKeyResponse:
      type: object
      properties:
        id:
          type: string
          description: API key's external ID
          example: apikey-abc123-v1
        key_name:
          type: string
          example: Production API Key
        raw_key:
          type: string
          description: |
            The actual API key value. **Only returned once at creation time.**
            Store this securely - it cannot be retrieved again.
          example: aion_sk_live_abc123xyz789...
        scopes:
          type: array
          items:
            type: string
          example:
            - read
            - write
        created_at:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        error:
          $ref: '#/components/schemas/AppError'
    AppError:
      type: object
      properties:
        code:
          type: string
          description: Error code (e.g., AUTH_001, USER_002)
          example: AUTH_002
        type:
          type: string
          enum:
            - validation
            - unauthorized
            - forbidden
            - not_found
            - conflict
            - internal
          example: unauthorized
        message:
          type: string
          description: User-friendly error message
          example: Invalid or expired authentication token
        details:
          type: string
          description: Additional error details (optional)
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT token from Auth0

````