Create an API key

POST https://rest.haasapi.com/v1/whitelabel/keys

Mints a new Partner-scoped API key. The full token is returned ONCE in this response - store it now; every later read is masked and it cannot be recovered. Send it as Authorization: Bearer <api_key> to call /v1/whitelabel.

Requires the whitelabel scope.

Request body

{
  "label": "production",
  "ip_allow_list": "203.0.113.7"
}

CreatePartnerKeyRequest

The request body for POST /v1/whitelabel/keys - create a Partner-scoped API key. The scope is fixed (whitelabel); you choose only a label and an optional IP allow-list.

Field	Type	Description
`label`	string, nullable	A name to recognise the key by. Optional.
`ip_allow_list`	string, nullable	Comma-separated IPs or CIDR ranges to restrict the key to (e.g. 203.0.113.7, 203.0.113.0/24). Omit for no restriction.

Example request

curl "https://rest.haasapi.com/v1/whitelabel/keys" \
  -X POST \
  -H "Authorization: Bearer hk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"production","ip_allow_list":"203.0.113.7"}'

Response

201 Created. Returns a PartnerKeyCreated.

{
  "id": "3f7c1e90-4a2b-4c8d-9e10-6b5a2f1d0c34",
  "api_key": "hk_live_8f14e45f-ceea-467a-9c9a-2b0f1d6a3c77",
  "label": "production",
  "scopes": "whitelabel",
  "ip_allow_list": "",
  "enabled": true,
  "created_at": "2026-08-28T19:04:11Z"
}

Fields

PartnerKeyCreated

The 201 body for POST /v1/whitelabel/keys. This is the ONE time the full token is returned - store it now; every later read is masked and it cannot be recovered.

Field	Type	Description
`id`	string	The key identifier - pass it to DELETE /v1/whitelabel/keys/{key_id} to revoke the key.
`api_key`	string	The full API key, shown ONCE. Send it as `Authorization: Bearer <api_key>` to call /v1/whitelabel. It cannot be retrieved again.
`label`	string, nullable	The name you gave the key. null if none.
`scopes`	string	The key’s scopes. Always `whitelabel`.
`ip_allow_list`	string	The IP allow-list applied to the key; empty if unrestricted.
`enabled`	boolean	Whether the key is active. A newly created key is always enabled.
`created_at`	string	When the key was created. RFC 3339 UTC.

Errors

All errors are RFC 9457 problem documents.

Status	Description
`400`	The request is malformed (invalid limit, unusable cursor, …). (`code: invalid_request`)
`401`	Missing, malformed, disabled, or revoked API key. (`code: invalid_api_key`)
`422`	An ip_allow_list entry is not a valid IP or CIDR range. (`code: invalid_ip_allow_list`)
`500`	An unexpected error inside the API. Nothing about the request caused it; retry, and quote the instance value if it persists. (`code: internal_error`)
`502`	An internal service answered in a way the API could not serve. Retry. (`code: upstream_error`)
`503`	The request could not be served right now. Retry with the same key - do not discard it. (`code: temporarily_unavailable`)
`504`	An internal service did not answer within the deadline. Retry with backoff. (`code: upstream_timeout`)

{
  "type": "https://docs.haasapi.com/errors/invalid_request",
  "title": "Invalid request",
  "status": 400,
  "detail": "The request is malformed (invalid limit, unusable cursor, …).",
  "code": "invalid_request"
}