Create and reveal an API key for a merchant user.

POST /api/api-keys/for-user deprecated

Requires: ApiKeyAuthorization.ApiKeys.CreateForUser, merchant scope.

Mints an API key owned by the target merchant user and returns it with the revealed value. A reseller or admin authorized over the user's merchant may call this. Every authorization or existence failure returns an identical not-found response.

Try this in the console

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a CreateApiKeyForMerchantUserDto. See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X POST "{{BASE_URL}}/api/api-keys/for-user" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}'

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/api-keys/for-user' `
    -Headers $headers -ContentType 'application/json' -Body $body

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, APIKeysApi } from '@winkpg/winkpg-api';

const api = new APIKeysApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.merchantUserApiKeysCreateForMerchantUser({
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
});

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/api-keys/for-user', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "",
    "expireAt": "2026-01-01T00:00:00Z"
  }),
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new APIKeysApi(config);
var body = JsonSerializer.Deserialize<CreateApiKeyForMerchantUserDto>("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    }
    """);

var result = await api.MerchantUserApiKeysCreateForMerchantUserAsync(body);

C# (raw HTTP)

using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/api-keys/for-user");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.APIKeysApi(client)
    body = winkpg_api.CreateApiKeyForMerchantUserDto.from_dict({
      "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "",
      "expireAt": "2026-01-01T00:00:00Z"
    })
    result = api.merchant_user_api_keys_create_for_merchant_user(body)

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "userId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "",
  "expireAt": "2026-01-01T00:00:00Z"
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/api-keys/for-user",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()

Parameters

Name	In	Type	Description
`suppressNulls` required	query	boolean	If true, omit properties with null values.

Request body

application/json , required

Field	Type	Description
`userId` required	string (uuid)	The identity user the key is minted for (the owner). Must be an active merchant user of `merchantId` in the current tenant.
`merchantId` required	string (uuid)	The merchant the target user belongs to, used for the server-side scope check.
`name` required	string	Human-readable key name. nullablemax length 32
`expireAt` required	string (date-time)	Required expiry. A durable credential provisioned for another user must not be immortal, so a null value is rejected. nullable

This request body has no documented fields.