Create API key

Free - does not consume credits

Store fullKey immediately and log only id and prefix.

response=$(curl -sS -X POST https://xquik.com/api/v1/api-keys \
  -H "Cookie: session_token=YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Production"}')
full_key=$(jq -r '.fullKey' <<<"$response")
key_id=$(jq -r '.id' <<<"$response")
key_prefix=$(jq -r '.prefix' <<<"$response")
# Store $full_key in your secret manager; do not print it in logs.
printf 'Created API key %s (%s)\n' "$key_id" "$key_prefix"

Headers

Dashboard session cookie. Format: session_token=YOUR_SESSION_TOKEN.

x-api-key

string

API key for the same account. Use this instead of Cookie for automated key rotation.

Authorization

string

OAuth bearer token for the same account. Format: Bearer YOUR_TOKEN.

Content-Type

string

required

Must be application/json.

Body

name

string

Display name for the key. Defaults to "Default" if omitted.

Response

201 Created
401 Unauthenticated
403 Key limit reached
429 Rate Limited

string

Unique identifier for the API key.

fullKey

string

The complete API key including the xq_ prefix.

prefix

string

First 8 characters of the key including the xq_ prefix (e.g. "xq_a1b2").

name

string

Display name of the key.

createdAt

string

ISO 8601 creation timestamp.

{
  "id": "42",
  "fullKey": "xq_YOUR_KEY_HERE",
  "prefix": "xq_a1b2",
  "name": "Production",
  "createdAt": "2026-02-24T10:30:00.000Z"
}

The fullKey is returned only once. Store it securely. It cannot be retrieved again.

{ "error": "unauthenticated" }

Missing or invalid session cookie, API key, or bearer token.

{ "error": "api_key_limit_reached", "limit": 100, "message": "API key limit reached. Delete an existing key first." }

You have reached the maximum number of active API keys (100). Revoke an active key before creating a new one. Revoked keys do not count toward the active limit.

{ "error": "rate_limit_exceeded", "message": "Too many requests. Try again later.", "retryAfter": 60 }

Too many requests. Wait for the Retry-After header before retrying.

Use a dashboard session cookie to create the first API key. Existing API keys and OAuth bearer tokens can create additional keys for the same account.Related: List API Keys · Revoke API Key

Documentation Index

​Headers

​Body

​Response

Headers

Body

Response