> ## Documentation Index
> Fetch the complete documentation index at: https://rain-sandbox-trial.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a key



## OpenAPI

````yaml post /issuing/keys
openapi: 3.0.3
info:
  title: Issuing API
  description: This is the specification for Rain's Issuing API.
  termsOfService: https://www.rain.xyz/legal/authorized-user-terms
  contact:
    email: support@rain.xyz
  version: 1.3.0
servers:
  - url: https://api-dev.rain.xyz/v1
    description: Sandbox server
  - url: https://api.rain.xyz/v1
    description: Production server
security: []
tags:
  - name: paymentRoutes
    description: >-
      **Endpoint Migration:** The `/v1/automations` endpoints have been renamed
      to `/v1/payment-routes`. The old `/v1/automations` paths remain available
      as deprecated aliases during migration. Update your integrations to use
      `/v1/payment-routes` as the deprecated endpoints will be removed in a
      future release.
  - name: simulate
    description: >-
      Transaction simulation endpoints for testing integration flows in
      non-production environments. These endpoints let you trigger transaction
      events programmatically to automate integration tests and verify webhook
      handling without depending on external systems or staging real deposits.
      **Sandbox only** — all simulation endpoints return `404 Not Found` in
      production.
  - name: raindrops
    description: >-
      Rewards and points management endpoints. Custom API keys need
      `raindrops:read`/`raindrops:write` for general rewards endpoints and
      `raindrops-travel:read`/`raindrops-travel:write` for travel redemption
      endpoints.
    x-group: rewards
paths:
  /issuing/keys:
    post:
      tags:
        - keys
      summary: Create a key
      operationId: createIssuingKey
      requestBody:
        description: The key to create
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - expiresAt
              properties:
                name:
                  type: string
                  description: The name of the key
                expiresAt:
                  type: string
                  description: The time the key expires
                role:
                  type: string
                  description: >-
                    The role of the key - if not provided, it will default to
                    `admin`
                  enum:
                    - admin
                    - readonly
                    - custom
                    - webhookSigning
                permissions:
                  type: array
                  description: >-
                    The permissions of the key - required if role is `custom`,
                    will ignore if provided and role is `admin`, `readonly`, or
                    `webhookSigning`. Must contain at least one permission.
                  items:
                    type: string
                    description: >-
                      Items must be in the format `resource:action` and
                      correspond to the available resources and actions in the
                      [Authenticating with the
                      API](/reference/authenticating-with-the-api) reference
                  example:
                    - applications:read
                    - transactionsAndDisputes:write
                    - cardsAndShipping:delete
                ipAddresses:
                  type: array
                  description: >-
                    Optional list of IP addresses or CIDR ranges that are
                    allowed to use this API key. If not provided or empty,
                    requests from any IP address are allowed. Supports both IPv4
                    and IPv6. Maximum 100 entries.
                  maxItems: 100
                  items:
                    type: string
                    description: >-
                      An IPv4 address (e.g., `192.168.1.1`), IPv6 address, or
                      CIDR range (e.g., `10.0.0.0/24`)
                  example:
                    - 192.168.1.1
                    - 10.0.0.0/24
                    - 2001:db8::1
              example:
                name: Limited access key
                role: custom
                expiresAt: '2027-01-01T00:00:00Z'
                permissions:
                  - applications:read
                  - transactionsAndDisputes:write
                  - cardsAndShipping:delete
                ipAddresses:
                  - 192.168.1.1
                  - 10.0.0.0/24
      responses:
        '201':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssuingKey'
        '400':
          description: Invalid request
        '401':
          description: Unauthorized
        '500':
          description: Internal server error
      security:
        - ApiKeyAuth: []
components:
  schemas:
    IssuingKey:
      type: object
      required:
        - id
        - key
        - name
        - expiresAt
      properties:
        id:
          type: string
          format: uuid
          description: The key's unique identifier
        key:
          type: string
          description: The key
        name:
          type: string
          description: The key's name
        expiresAt:
          type: string
          format: date-time
          description: The time at which the key expires
        role:
          type: string
          description: The key's role
          enum:
            - admin
            - readonly
            - custom
            - webhookSigning
        permissions:
          type: array
          description: The key's permissions
          items:
            type: string
        ipAddresses:
          type: array
          description: >-
            The IP addresses or CIDR ranges allowed to use this key. If empty,
            any IP is allowed. Maximum 100 entries.
          maxItems: 100
          items:
            type: string
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: Api-Key
      in: header

````