curl --request POST \
  --url https://api.arize.com/v2/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "key_type": "USER",
  "name": "My dev key"
}
'

{
  "id": "QXBpS2V5OjEwMDE6YUJjRA==",
  "name": "My dev key",
  "key_type": "USER",
  "status": "ACTIVE",
  "key": "ak-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
  "redacted_key": "ak-abc...xyz",
  "created_by_user_id": "VXNlcjoxMDAxOm5OYkM=",
  "created_at": "2024-01-15T10:30:00Z",
  "expires_at": "2025-01-15T10:30:00Z"
}

API Keys

Create an API key

Create a new API key for the authenticated user.

Choose key_type: "USER" for a personal key that authenticates as you, or key_type: "SERVICE" for an automated service account key. The field is required.
For service keys, supply at least one space via the organizations array. The service account is granted membership in each specified space. Multiple organizations and multiple spaces per organization are supported.
For USER keys, the key inherits the authenticated user’s own permissions.
You may only assign roles at or below your own privilege level. Attempting to assign a role higher than your own returns 422 Unprocessable Entity.
All roles default to minimum privilege when omitted: space roles default to MEMBER, organization roles default to READ_ONLY, and account_role defaults to MEMBER.

Authorization:

User keys: Requires the developer user permission flag. Returns 403 when this flag is absent.
Service keys: Requires the SERVICE_KEY_CREATE permission in the target space (space member or above).

The full API key value (key) is only returned once in the creation response. Store it securely — it cannot be retrieved again. Use the redacted_key field on subsequent reads.

This endpoint is in beta, read more here.

POST

api-keys

curl --request POST \
  --url https://api.arize.com/v2/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "key_type": "USER",
  "name": "My dev key"
}
'

{
  "id": "QXBpS2V5OjEwMDE6YUJjRA==",
  "name": "My dev key",
  "key_type": "USER",
  "status": "ACTIVE",
  "key": "ak-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
  "redacted_key": "ak-abc...xyz",
  "created_by_user_id": "VXNlcjoxMDAxOm5OYkM=",
  "created_at": "2024-01-15T10:30:00Z",
  "expires_at": "2025-01-15T10:30:00Z"
}

Authorizations

Authorization

string

header

required

Most Arize AI endpoints require authentication. For those endpoints that require authentication, include your API key in the request header using the format

Body

application/json

Body containing API key creation parameters

Option 1
Option 2

Request body for creating an API key. Set key_type to select the kind of key:

USER — authenticates as the creating user, inheriting their current permissions.
SERVICE — authenticates as a service account: a dedicated, automatically provisioned identity with roles explicitly configured in the spaces you specify. Use this for automation, CI/CD pipelines, or any workload that should run independently of a specific user.

key_type

enum<string>

required

The type of key to create. Use "USER" for a personal key that authenticates as you with your current permissions. Use "SERVICE" for a key tied to a dedicated service account with its own explicitly configured access across one or more spaces.

Available options:

USER

name

string

required

User-defined name for the API key.

Maximum string length: 256

Example:

"My dev key"

description

string

Optional user-defined description for the API key.

Maximum string length: 1000

Example:

"Used for local development."

expires_at

string<date-time>

Optional expiration timestamp. If omitted the key never expires.

Example:

"2026-01-01T00:00:00Z"

Response

API key successfully created or refreshed. The raw key is only returned once.

Option 1
Option 2

Response for a newly created or refreshed API key. The key_type field discriminates the variant:

USER — standard user key; no bot user.
SERVICE — service key tied to a service account; includes a bot_user with the service account's resolved role assignments.

string

required

Unique identifier for the API key.

name

string

required

User-defined name for the API key.

key_type

enum<string>

required

Discriminator value for user keys.

Available options:

USER

status

enum<string>

required

Current status of the API key.

ACTIVE - The key is valid for use.
REVOKED - The key has been revoked and is no longer valid.

Available options:

ACTIVE,

REVOKED

redacted_key

string

required

Redacted version of the key suitable for display (e.g., "ak-abc...xyz").

created_at

string<date-time>

required

Timestamp when the key was created.

created_by_user_id

string

required

ID of the user who created the key.

key

string

required

The full API key value. Only returned once at creation or refresh time. Store it securely — it cannot be retrieved again.

description

string

Optional user-defined description for the API key.

expires_at

string<date-time>

Optional timestamp when the key will expire.

last_used_at

string<date-time>

Approximate timestamp when the key was last used for authentication. This value is periodically updated and may not reflect the most recent usage.

List API keys Refresh an API key

⌘I

API reference

API clients

Create an API key

Authorizations

Body

Response