Create and reveal an API key for a merchant user.

POST /api/api-keys/for-user deprecated

Requires: ApiKeyAuthorization.ApiKeys.CreateForUser, merchant scope.

Mints an API key owned by the target merchant user and returns it with the revealed value. A reseller or admin authorized over the user's merchant may call this. Every authorization or existence failure returns an identical not-found response.

Signed in, you can send this request to your own sandbox merchant from the console and read the answer. Sign in to try it.

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a CreateApiKeyForMerchantUserDto. See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X POST "{{BASE_URL}}/api/api-keys/for-user" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}'

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/api-keys/for-user' `
    -Headers $headers -ContentType 'application/json' -Body $body

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, APIKeysApi } from '@winkpg/winkpg-api';

const api = new APIKeysApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.merchantUserApiKeysCreateForMerchantUser({
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
});

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/api-keys/for-user', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "",
    "expireAt": "2026-01-01T00:00:00Z"
  }),
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new APIKeysApi(config);
var body = JsonSerializer.Deserialize<CreateApiKeyForMerchantUserDto>("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    }
    """);

var result = await api.MerchantUserApiKeysCreateForMerchantUserAsync(body);

C# (raw HTTP)

using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/api-keys/for-user");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.APIKeysApi(client)
    body = winkpg_api.CreateApiKeyForMerchantUserDto.from_dict({
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    })
    result = api.merchant_user_api_keys_create_for_merchant_user(body)

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/api-keys/for-user",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()

Parameters

Name	In	Type	Description
`suppressNulls` required	query	boolean	If true, omit properties with null values.

Request body

application/json , required

Field	Type	Description
`userId` required	string (uuid)	The identity user the key is minted for (the owner). Must be an active merchant user of `merchantId` in the current tenant.
`merchantId` required	string (uuid)	The merchant the target user belongs to, used for the server-side scope check.
`name` required	string	Human-readable key name. nullablemax length 32
`expireAt` required	string (date-time)	Required expiry. A durable credential provisioned for another user must not be immortal, so a null value is rejected. nullable

This request body has no documented fields.