> ## Documentation Index
> Fetch the complete documentation index at: https://starcovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

> Mint product API key. Plaintext secret returned once. Agent access tokens receive 403.



## OpenAPI

````yaml POST /api/keys
openapi: 3.1.0
info:
  description: >-
    Starcovery helps you find and hire real Instagram and TikTok creators from a
    plain-language brief, on the web or from your agents. REST and MCP API.
    Search accepts unsigned callers. Campaigns, billing state, and keys accept
    browser session, x-api-key, or Bearer. MCP accepts OAuth, x-api-key, Bearer,
    or last-resort ?api_key= (no session). Machine Payments Protocol
    (x-payment-info) on GET /api/search when provisioned. Signup and claim at
    auth.md.
  title: Starcovery
  version: 1.0.0
servers:
  - url: https://www.starcovery.com
security: []
paths:
  /api/keys:
    post:
      summary: Create API key
      description: >-
        Mint product API key. Plaintext secret returned once. Agent access
        tokens receive 403.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiKeyName'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                additionalProperties: false
                properties:
                  key:
                    $ref: '#/components/schemas/ApiKeyCreated'
                required:
                  - key
                type: object
          description: Created key with plaintext secret
        '400':
          description: invalid_body
        '401':
          description: >-
            unauthorized: missing identity; WWW-Authenticate points at
            protected-resource metadata
        '403':
          description: 'forbidden: agent access token cannot manage keys'
        '429':
          description: Rate limited
      security:
        - ApiKeyHeader: []
        - BearerAuth: []
        - SessionCookie: []
components:
  schemas:
    ApiKeyName:
      additionalProperties: false
      properties:
        name:
          description: 'Key label; must not start with agent:'
          maxLength: 64
          minLength: 1
          type: string
      required:
        - name
      type: object
    ApiKeyCreated:
      additionalProperties: false
      properties:
        id:
          type: string
        key:
          description: Plaintext secret; returned only on create
          type: string
        name:
          type:
            - string
            - 'null'
      required:
        - id
        - key
        - name
      type: object
  securitySchemes:
    ApiKeyHeader:
      description: Product API key or agent access token
      in: header
      name: x-api-key
      type: apiKey
    BearerAuth:
      bearerFormat: access token
      description: >-
        Bearer access token (agent registration), product API key, or MCP OAuth
        access token
      scheme: bearer
      type: http
    SessionCookie:
      description: >-
        Browser better-auth session cookie (REST only; MCP rejects sessions).
        Name is better-auth.session_token, or __Secure-better-auth.session_token
        on HTTPS.
      in: cookie
      name: better-auth.session_token
      type: apiKey

````