Skip to main content
POST
Xquik API key creation & request authentication

When to create a key

Use this route only when creating a new credential. fullKey appears at creation, so store it immediately in a secret manager. List operations return inventory data and never replace this storage step.
Free. This endpoint does not consume credits.
Store fullKey immediately and log only id and prefix.

Headers

Dashboard session cookie. Format: session_token=YOUR_SESSION_TOKEN.
string
required
Must be application/json.

Body

string
Display name for the key. Defaults to "Default" if omitted.

Response

201 Created

string
Unique identifier for the API key.
string
The complete API key including the xq_ prefix.
string
First 8 characters of the key including the xq_ prefix (for example "xq_a1b2").
string
Display name of the key.
string
ISO 8601 creation timestamp.
Xquik returns fullKey once. Store it in a secret manager. You cannot retrieve it again.

401 Unauthenticated

Missing, expired, or invalid dashboard session cookie.

403 Key limit reached

You have reached the maximum number of active API keys (100). Revoke an active key before creating a new one. Revoked keys do not count toward the active limit.

429 Rate limited

Too many requests. Wait for the Retry-After header before retrying.
API key creation requires a same-origin dashboard session. API keys and OAuth bearer tokens cannot create more keys.Related. List API Keys · Revoke API Key