> This page is for Cash App Pay Partner API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.cash.app/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.cash.app/_mcp/server.

# Create API key

POST https://api.cash.app/management/v1/api-keys
Content-Type: application/json

Creates a new API key and secret to use in the `Authorization` and `X-Signature` headers for requests to the Cash App Pay API. This key will automatically expire at the date and time specified in the `expires_at` field in the response payload.

The `secret` returned in the response payload is what you use to calculate the `X-Signature` header. The API key ID is only used to keep track of which API keys are active, and isn't considered secret.
Keep in mind that the `secret` can never be retrieved in subsequent requests to the API, so make sure to store it immediately!

**This endpoint is rate limited to 5 QPS.**

Scopes: `API_KEYS_WRITE`

Reference: https://developers.cash.app/cash-app-pay-partner-api/api-reference/management-api/create-api-key

## Servers

- `https://api.cash.app/management/v1` (Production, default)
- `https://sandbox.api.cash.app/management/v1` (Sandbox)

## Request

### Body (application/json)

This endpoint expects an object.

- `idempotency_key` (string, required) — A unique identifier which can be used by Cash App to de-duplicate retries of this request, making it idempotent. Learn more about [idempotency](../docs/api/technical-documentation/api-fundamentals/idempotency) in the API.
- `api_key` (ApiKeysPostRequestBodyContentApplicationJsonSchemaApiKey, required) — Details about the API key to create.

## Response

### 201

Created

- `api_key` (ApiKey, required)
- `secret` (string, required) — Secret value to use when calculating the `X-Signature` header of requests. This value is not returned when retrieving an API key, so make sure to store it immediately. Min length: `32` Max length: `256`

## Errors

### 400 Bad Request Error

Bad Request

- `errors` (list of Error, required) — A list of errors that occurred while processing the request. Min number of items: `1`

## Types

### ApiKeysPostRequestBodyContentApplicationJsonSchemaApiKey

Details about the API key to create.

- `scopes` (list of enum, required) — An array of permissions granted to the API key. Current values: - `API_KEYS_READ`: Permits listing API keys and retrieving individual keys. - `API_KEYS_WRITE`: Permits creating and deleting API keys. - `BRANDS_READ`: Permits listing brands and retrieving individual brands. - `BRANDS_WRITE`: Permits creating, upserting, and updating brands. - `CUSTOMERS_READ`: Permits listing customers and retrieving individual customers. - `DISPUTES_READ`: Permits listing disputes / dispute evidence and retrieving details about individual disputes / dispute evidence. - `DISPUTES_WRITE`: Permits uploading dispute evidence, accepting disputes, and challenging disputes. - `FEE_PLANS_READ`: Permits listing fee plans and retrieving individual fee plans. - `GRANTS_READ`: Permits listing grants for a customer and retrieving individual grants. - `GRANTS_WRITE`: Permits revoking a grant. - `MERCHANTS_READ`: Permits listing merchants and retrieving individual merchants. - `MERCHANTS_WRITE`: Permits creating, upserting, and updating merchants. - `PAYMENTS_READ`: Permits listing payments and retrieving individual payments. - `PAYMENTS_WRITE`: Permits taking payments, capturing payments, and voiding payments. - `PAYOUTS_READ`: Permits listing payouts and retrieving individual payouts. - `PAYOUTS_WRITE`: Permits creating payouts. - `REFUNDS_READ`: Permits listing refunds and retrieving individual refunds. - `REFUNDS_WRITE`: Permits issuing refunds, capturing refunds, and voiding refunds. - `WEBHOOK_CONFIG_READ`: Permits listing webhook delivery settings and retrieving individual configurations. - `WEBHOOK_CONFIG_WRITE`: Permits creating and updating webhook delivery settings. - `WEBHOOK_EVENTS_READ`: Permits listing webhook events and retrieving individual events. Min number of items: `1`
  - Allowed values: `PAYMENTS_READ`, `PAYMENTS_WRITE`, `PAYOUTS_READ`, `PAYOUTS_WRITE`, `REFUNDS_READ`, `REFUNDS_WRITE`, `DISPUTES_READ`, `DISPUTES_WRITE`, `CUSTOMERS_READ`, `FEE_PLANS_READ`, `GRANTS_READ`, `GRANTS_WRITE`, `API_KEYS_READ`, `API_KEYS_WRITE`, `BRANDS_READ`, `BRANDS_WRITE`, `MERCHANTS_READ`, `MERCHANTS_WRITE`, `WEBHOOK_CONFIG_READ`, `WEBHOOK_CONFIG_WRITE`, `WEBHOOK_EVENTS_READ`
- `reference_id` (string, optional) — A user-defined identifier for this API key, typically used to associate the API key with a record in an external system. Min length: `1` Max length: `1024`

### ApiKey

- `id` (string, required) — Unique identifier for this API key issued by Cash App. This is the API key value that is passed in the `Authorization` header.
- `created_at` (datetime, required) — When this API key was created, in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format (UTC).
- `expires_at` (datetime, required) — When this API key will be automatically deleted and become unusable, in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format (UTC).
- `scopes` (list of enum, required) — An array of permissions granted to the API key. Current values: - `API_KEYS_READ`: Permits listing API keys and retrieving individual keys. - `API_KEYS_WRITE`: Permits creating and deleting API keys. - `BRANDS_READ`: Permits listing brands and retrieving individual brands. - `BRANDS_WRITE`: Permits creating, upserting, and updating brands. - `CUSTOMERS_READ`: Permits listing customers and retrieving individual customers. - `DISPUTES_READ`: Permits listing disputes / dispute evidence and retrieving details about individual disputes / dispute evidence. - `DISPUTES_WRITE`: Permits uploading dispute evidence, accepting disputes, and challenging disputes. - `FEE_PLANS_READ`: Permits listing fee plans and retrieving individual fee plans. - `GRANTS_READ`: Permits listing grants for a customer and retrieving individual grants. - `GRANTS_WRITE`: Permits revoking a grant. - `MERCHANTS_READ`: Permits listing merchants and retrieving individual merchants. - `MERCHANTS_WRITE`: Permits creating, upserting, and updating merchants. - `PAYMENTS_READ`: Permits listing payments and retrieving individual payments. - `PAYMENTS_WRITE`: Permits taking payments, capturing payments, and voiding payments. - `PAYOUTS_READ`: Permits listing payouts and retrieving individual payouts. - `PAYOUTS_WRITE`: Permits creating payouts. - `REFUNDS_READ`: Permits listing refunds and retrieving individual refunds. - `REFUNDS_WRITE`: Permits issuing refunds, capturing refunds, and voiding refunds. - `WEBHOOK_CONFIG_READ`: Permits listing webhook delivery settings and retrieving individual configurations. - `WEBHOOK_CONFIG_WRITE`: Permits creating and updating webhook delivery settings. - `WEBHOOK_EVENTS_READ`: Permits listing webhook events and retrieving individual events. Min number of items: `1`
  - Allowed values: `PAYMENTS_READ`, `PAYMENTS_WRITE`, `PAYOUTS_READ`, `PAYOUTS_WRITE`, `REFUNDS_READ`, `REFUNDS_WRITE`, `DISPUTES_READ`, `DISPUTES_WRITE`, `CUSTOMERS_READ`, `FEE_PLANS_READ`, `GRANTS_READ`, `GRANTS_WRITE`, `API_KEYS_READ`, `API_KEYS_WRITE`, `BRANDS_READ`, `BRANDS_WRITE`, `MERCHANTS_READ`, `MERCHANTS_WRITE`, `WEBHOOK_CONFIG_READ`, `WEBHOOK_CONFIG_WRITE`, `WEBHOOK_EVENTS_READ`
- `reference_id` (string, optional) — A user-defined identifier for this API key, typically used to associate the API key with a record in an external system. Min length: `1` Max length: `1024`

### Error

Represents an error encountered during a request to the API.

- `category` (enum, required) — The high-level reason the error occurred
  - Allowed values: `API_ERROR`, `AUTHENTICATION_ERROR`, `BRAND_ERROR`, `DISPUTE_ERROR`, `MERCHANT_ERROR`, `INVALID_REQUEST_ERROR`, `PAYMENT_PROCESSING_ERROR`, `RATE_LIMIT_ERROR`, `WEBHOOK_ERROR`, `API_KEY_ERROR`, `GRANT_ERROR`
- `code` (string, required) — A unique identifier for the specific type of error that occurred. See the Error Code Reference for more information. Min length: `1`
- `detail` (string, optional) — Human-readable description of why the error occurred and how to resolve it. Min length: `1`
- `field` (string, optional) — The field in the request that caused the error, using array and object dot notation. Min length: `1`

## Examples

**Request**

```json
{
  "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
  "api_key": {
    "scopes": [
      "PAYMENTS_READ"
    ]
  }
}
```

**Response**

```json
{
  "api_key": {
    "id": "KEY_test_do_not_use",
    "created_at": "2022-01-01T00:00:00Z",
    "expires_at": "2022-02-01T00:00:00Z",
    "scopes": [
      "PAYMENTS_READ"
    ],
    "reference_id": "string"
  },
  "secret": "string"
}
```

**SDK Code**

```python
import requests

url = "https://api.cash.app/management/v1/api-keys"

payload = {
    "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
    "api_key": { "scopes": ["PAYMENTS_READ"] }
}
headers = {
    "Accept": "Accept",
    "User-Agent": "User-Agent",
    "X-Region": "X-Region",
    "X-Signature": "X-Signature",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.cash.app/management/v1/api-keys';
const options = {
  method: 'POST',
  headers: {
    Accept: 'Accept',
    'User-Agent': 'User-Agent',
    'X-Region': 'X-Region',
    'X-Signature': 'X-Signature',
    'Content-Type': 'application/json'
  },
  body: '{"idempotency_key":"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19","api_key":{"scopes":["PAYMENTS_READ"]}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cash.app/management/v1/api-keys"

	payload := strings.NewReader("{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Accept", "Accept")
	req.Header.Add("User-Agent", "User-Agent")
	req.Header.Add("X-Region", "X-Region")
	req.Header.Add("X-Signature", "X-Signature")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.cash.app/management/v1/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Accept"] = 'Accept'
request["User-Agent"] = 'User-Agent'
request["X-Region"] = 'X-Region'
request["X-Signature"] = 'X-Signature'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.cash.app/management/v1/api-keys")
  .header("Accept", "Accept")
  .header("User-Agent", "User-Agent")
  .header("X-Region", "X-Region")
  .header("X-Signature", "X-Signature")
  .header("Content-Type", "application/json")
  .body("{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.cash.app/management/v1/api-keys', [
  'body' => '{
  "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
  "api_key": {
    "scopes": [
      "PAYMENTS_READ"
    ]
  }
}',
  'headers' => [
    'Accept' => 'Accept',
    'Content-Type' => 'application/json',
    'User-Agent' => 'User-Agent',
    'X-Region' => 'X-Region',
    'X-Signature' => 'X-Signature',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.cash.app/management/v1/api-keys");
var request = new RestRequest(Method.POST);
request.AddHeader("Accept", "Accept");
request.AddHeader("User-Agent", "User-Agent");
request.AddHeader("X-Region", "X-Region");
request.AddHeader("X-Signature", "X-Signature");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"idempotency_key\": \"e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19\",\n  \"api_key\": {\n    \"scopes\": [\n      \"PAYMENTS_READ\"\n    ]\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Accept": "Accept",
  "User-Agent": "User-Agent",
  "X-Region": "X-Region",
  "X-Signature": "X-Signature",
  "Content-Type": "application/json"
]
let parameters = [
  "idempotency_key": "e345c3fb-1caa-46fd-b0d3-aa6c7b00ab19",
  "api_key": ["scopes": ["PAYMENTS_READ"]]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.cash.app/management/v1/api-keys")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```