> ## Documentation Index > Fetch the complete documentation index at: https://docs.beinfi.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an API key > The full secret is returned only in this response, in `value`. Store it right away: there is no way to read it again. If it is lost, revoke the key and create a new one. ## OpenAPI ````yaml /api-reference/openapi.en.json post /account/api-keys openapi: 3.1.0 info: title: Infi API version: 0.0.1 description: > The Infi REST API: catalog, customers, usage metering, subscriptions, invoices, payments and checkout. **Authentication.** Send your secret key as `Authorization: Bearer sk_test_…` (sandbox) or `sk_live_…` (production). The key prefix selects the environment. Checkout routes (`/pay/*`) and `/public/*` take no key: they run in the payer's browser. **Idempotency.** Every request that changes data requires an `Idempotency-Key` header. A retry with the same key returns the original response instead of running again. **Amounts.** Money and quantities travel as decimal strings (`"150.00"`, `"0.0001"`), never as floating-point numbers. **Errors.** The body carries `error_code` (stable, branch on it), `message` (for humans) and `tracer_id` (send it to support). Rate-limit and idempotency errors are nested under `error`, with `code` and `request_id`. servers: - url: https://api-sandbox.beinfi.com description: Sandbox - url: https://api.beinfi.com description: Production security: - bearerAuth: [] tags: - name: Catalog - name: Customers - name: Metering - name: Subscriptions - name: Invoices - name: Payments - name: Checkout - name: Coupons - name: Billing - name: Account - name: Webhooks - name: Test account - name: Rail - name: Storefronts paths: /account/api-keys: post: tags: - Account summary: Create an API key description: | The full secret is returned only in this response, in `value`. Store it right away: there is no way to read it again. If it is lost, revoke the key and create a new one. operationId: createApiKey parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: tier: type: string enum: - free - pro - enterprise description: The key's rate-limit tier. scopes: type: array items: type: string description: >- The key's permissions. Empty grants full access to the account. kind: type: string enum: - secret - publishable default: secret description: >- `secret` (default) for your server; `publishable` for the browser. responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreatedApiKey' description: Created. '401': $ref: '#/components/responses/Unauthorized' '422': $ref: '#/components/responses/ValidationFailed' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false schema: type: string description: >- A unique key per operation (a UUID works). Retrying with the same key returns the original response. schemas: CreatedApiKey: allOf: - $ref: '#/components/schemas/ApiKey' - type: object properties: secret: type: string description: The new key, with the full secret in `value`. ApiKey: type: object properties: id: type: string format: uuid prefix: type: string example: sk_live description: '`sk_test`, `sk_live`, `pk_test` or `pk_live`.' kind: type: string enum: - secret - publishable default: secret lastFour: type: string description: The last four characters tier: type: string enum: - free - pro - enterprise description: Rate-limit tier. scopes: type: array items: type: string revokedAt: type: - string - 'null' format: date-time description: When it was revoked. `null` while active. createdAt: type: string format: date-time value: type: string description: The full secret. Only present in the create response. Error: type: object required: - message - error_code - tracer_id properties: message: type: string description: Human-readable sentence. error_code: $ref: '#/components/schemas/ErrorCode' description: Stable error code. Branch on it. tracer_id: type: string description: Request id. Include it when contacting support. description: >- The standard error body. It is flat (no `error` wrapper) and the trace id is `tracer_id`. ValidationError: type: object required: - message - error_code - tracer_id - errors properties: message: type: string error_code: $ref: '#/components/schemas/ErrorCode' tracer_id: type: string errors: type: array items: type: object required: - field - value - constraint - description properties: field: type: string value: type: string constraint: type: string description: type: string description: >- Per-field detail (`field`, `description`). Always present on a `422`; may be empty. description: >- Body of a `422`. Same shape as `Error`, plus `errors[]` with per-field detail. That is where the sentence telling you what to fix lives (for example, "product has no published version"). ErrorCode: type: string examples: - internal_error - validation_failed - bad_request - unauthorized - forbidden - not_found - conflict - rate_limited description: >- Stable error code. The list is open: besides the generic codes, each area defines its own (`coupon_expired`, `insufficient_balance`, `version_not_draft`, `idempotency_key_reused`…). Handle a code you do not recognize by its HTTP status and show `message`; do not fail parsing the response. responses: Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Missing or invalid API key. ValidationFailed: content: application/json: schema: $ref: '#/components/schemas/ValidationError' description: One or more fields are invalid. Per-field detail is in `errors[]`. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your account's secret key: `Authorization: Bearer sk_test_…` or `sk_live_…`. Server-side only. ````