# Create a child key

URL: https://docs.healthcare.dev/reference/keys/create-a-child-key

```http
POST https://api.healthcare.dev/v1/keys
```

Create a child key on your account, with optional scopes (the route groups it may call), its own requests-a-second limit and a monthly spend cap. Its calls bill to your account and count toward your account's quota, rate limit and spend cap, which still apply. The full key is in this response only; store it now. Call with a parent key. Pro and Team.

Requires an API key: `Authorization: Bearer hdev_live_...`. See [Authentication](/authentication).

## Request body

```json
{
  "name": "string",
  "env": "live",
  "scopes": [
    "codes"
  ],
  "rps_limit": 1,
  "monthly_cap_cents": 0
}
```

## Examples

**curl**

```sh
curl -X POST "https://api.healthcare.dev/v1/keys" \
  -H "Authorization: Bearer $HDEV_API_KEY"
```

**TypeScript**

```ts
const res = await fetch("https://api.healthcare.dev/v1/keys", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();
```

**Python**

```python
import os
import requests

res = requests.post("https://api.healthcare.dev/v1/keys", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()
```

## Response

Created; `data.key` is the full key, shown once

```json
{
  "data": {
    "id": "string",
    "name": "string",
    "prefix": "string",
    "env": "live",
    "scopes": [
      "codes"
    ],
    "rps_limit": 1,
    "monthly_cap_cents": 1,
    "month_to_date": {
      "calls": 1,
      "spend_cents": 1
    },
    "created_at": "string",
    "last_used_at": "string",
    "revoked_at": "string",
    "key": "string"
  },
  "meta": {
    "source": "cms-icd10",
    "data_version": "2026.1",
    "retrieved_at": "2026-10-24T12:00:00Z",
    "license": "Public domain (CMS). Reference data, not medical advice."
  },
  "links": {
    "self": "/v1/keys",
    "next": null
  }
}
```

## Errors

Errors are `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)). Branch on `type`, not on `title`. See [Errors](/errors).

| Status | `type` | When |
| --- | --- | --- |
| 400 | `invalid-request` | A parameter or the body failed validation; `errors` lists each field. |
| 401 | `unauthorized` | Missing, malformed or revoked API key. |
| 403 | `plan-upgrade-required` | The plan doesn't include this feature; `required_plan` names the plan that does. |
| 409 |  | The account already holds the most active child keys allowed |
| 429 | `rate-limited / quota-exceeded` | Too many requests per second (retry after `Retry-After`), or the monthly quota is used up. |