> ## Documentation Index > Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt > Use this file to discover all available pages before exploring further. # Create API key > Generates a new scoped API key. The raw key is returned only once. ## OpenAPI ````yaml /api-reference/openapi.selfhost.json post /api/account/keys openapi: 3.0.0 info: contact: {} description: >- Self-hosted Polymorfa REST, tenant-account, and instance-administration API. Use the generated operations for exact request and response schemas. SaaS Console-only routes are not included. title: Polymorfa API version: '1.0' servers: - url: https://your-instance.example.com description: Your self-hosted instance security: - ApiKey: [] tags: - description: >- Manage WhatsApp Channels (newsletters): create, follow/unfollow, mute/unmute, and retrieve channel information. name: channels - description: >- Register webhook endpoints to receive real-time events (messages, status changes, group updates, etc.). Configure event filtering, retry policies, HMAC signature verification, and custom headers. name: webhooks - description: >- Resolve WhatsApp Linked Device IDs (LIDs) to phone numbers (PNJIDs) and vice versa. name: lids - description: Server version and status information. No authentication required. name: info - description: >- Send messages (text, image, video, audio, document, location, contact, poll), mark messages as read, send typing indicators, and react to messages with emoji. name: messages - description: >- Manage chat-level operations: edit sent messages, delete messages, and archive/unarchive conversations. name: chats - description: >- Read and write online/offline presence status. Subscribe to presence updates for specific contacts to receive real-time typing and online notifications via webhooks. name: presence - description: >- Create, update, and delete WhatsApp Business labels. Assign labels to chats for organization and filtering. name: labels - description: >- Full group management: create groups, update subject/description/picture, manage participants (add, remove, promote, demote), handle invite links, and join groups. name: groups - description: >- Read and update your WhatsApp profile: display name, status text, and profile picture. name: profile - description: >- Download and manage media files (images, videos, documents) from received messages. Media can be downloaded on-demand or auto-persisted to S3-compatible storage. name: media - description: >- Health check and readiness probes for load balancers and orchestrators. No authentication required. name: health - description: Manage your tenant account and API keys (SaaS edition). name: account - description: >- Configure instance settings: rate limits, debug mode, S3 storage, and license info (self-hosted edition). name: settings - description: >- Link a WhatsApp account to a session using QR code scanning or phone number pairing code. After creating a session, use one of these methods to authenticate it with WhatsApp. name: pairing - description: >- Look up contacts, check phone number registration on WhatsApp, retrieve profile pictures, and manage your block list. name: contacts - description: Administrative endpoints for tenant management (SaaS edition). name: admin - description: Create, list, rotate, and revoke API keys (self-hosted edition). name: keys - description: >- Create, start, stop, and manage WhatsApp sessions. A session represents a single WhatsApp account connection. Sessions must be paired via QR code or pairing code before they can send or receive messages. name: sessions paths: /api/account/keys: post: tags: - account summary: Create API key description: Generates a new scoped API key. The raw key is returned only once. operationId: createApiKey requestBody: $ref: '#/components/requestBodies/CreateAPIKeyRequest' responses: '201': content: application/json: schema: $ref: '#/components/schemas/APIKeyCreateResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/BadRequestError' description: Invalid request '401': content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' description: Unauthorized '500': content: application/json: schema: $ref: '#/components/schemas/InternalServerError' description: Internal server error default: content: application/json: schema: properties: docs: description: Link to relevant API documentation type: string error: description: Human-readable error message type: string type: object description: Error response components: requestBodies: CreateAPIKeyRequest: content: application/json: schema: $ref: '#/components/schemas/CreateAPIKeyRequest' description: Key parameters required: true schemas: APIKeyCreateResponse: properties: createdAt: description: When the key was created type: string expiresAt: description: When the key expires type: string id: description: Unique API key identifier type: string key: description: Full API key (only returned once at creation, store securely) type: string label: description: Human-readable label for the key type: string scopes: description: Permission scopes granted to this key as string names items: type: string type: array type: object BadRequestError: properties: docs: description: Link to relevant API documentation example: https://docs.polymorfa.com/api/messages/send type: string error: description: Human-readable error message example: 'missing required field: chatId' type: string type: object UnauthorizedError: properties: error: description: Human-readable error message example: missing or invalid API key type: string type: object InternalServerError: properties: error: description: Human-readable error message example: internal server error type: string type: object CreateAPIKeyRequest: properties: label: description: Human-readable label for the key example: My API Key type: string lifetimeDays: description: >- Key lifetime in days (required, max configurable via MAX_API_KEY_LIFETIME_DAYS) example: 90 type: integer scopes: description: >- Permission scopes to grant (string names converted to bitmask internally). Valid values: *, sessions:read, sessions:manage, messages:write, chats:read, chats:manage, contacts:read, contacts:manage, groups:read, groups:manage, channels:read, channels:manage, status:write, presence:read, presence:write, labels:read, labels:manage, profile:read, profile:write, webhooks:manage, media:read, media:manage items: type: string type: array type: object securitySchemes: ApiKey: description: Scoped API key created via POST /api/account/keys. scheme: bearer type: http ````