---
id: create
title: "Create API secret"
sidebar_label: Create
hide_title: true
description: "Management API - Organization - API secrets - Create"
---

import Tabs from "@theme/Tabs";
import TabItem from "@theme/TabItem";
import Ingress from "../../../../src/components/ingress/ingress.react";

<Ingress title="Create API secret">
  To access the Walley API, a valid token is required, which can be obtained
  using a client ID and API secret. The initial secret is generated within the
  Merchant Hub. However, additional secrets can be generated using the API.
</Ingress>

Create the first secret in the Merchant Hub. After that, use this endpoint for the rest. An
organization can hold two active secrets at a time.

:::warning The secret is shown once
The response is the only place you will ever see `apiSecret`. Store it somewhere safe before you
close the response.
:::

## Example

<Tabs defaultValue="req" values={[
{ label: 'Request', value: 'req', },
{ label: 'Response', value: 'res', },
]}>
<TabItem value="req">

```http
POST /manage/organizations/{{orgId}}/apisecrets HTTP/1.1
Host: api.uat.walleydev.com // Test environment. Production uses a different hostname.
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "label": "Name of secret",
  "expirationDate": null
}
```

</TabItem>
<TabItem value="res">

```json
{
  "entityId": "83119b40-4a7d-454d-beda-26647f89e2fc",
  "metadata": {
    "clientId": "6a8efa5b-378b-44f5-bfc6-3b5d61f0d314",
    "apiSecret": "CR6qTkUAkKxwCWx7UwJgN7XX59sLzCwGdQu9TKyAbmWGBRWAkBd9NRBeFz2D",
    "expiresAt": "2020-01-01T00:00:00.0000000+00:00"
  }
}
```

</TabItem>
</Tabs>

## Data Model

### Request

#### Request path

| Path      | Required | Explanation                                                                      |
| --------- | -------- | -------------------------------------------------------------------------------- |
| **orgId** | Yes      | The id of the organization, to obtain the `orgId` please contact help@walley.se. |

#### Request headers

| Header            | Required | Explanation                                                                                                             |
| ----------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Authorization** | Yes      | See [Authentication](/docs/manage/getting-started/authentication) for how to generate the Bearer token value |

#### Request body

| Property           | Required | Explanation                                                                                | Type   | Notes |
| ------------------ | -------- | ------------------------------------------------------------------------------------------ | ------ | ----- |
| **label**          | No       | Only a text that makes it easier to tell secrets apart.                                    | string |       |
| **expirationDate** | No       | A date between creation and 99 years in the future. The default is 6 months from creation. | date   |       |

### Response

The response will be `201 Created` for a successful creation.

#### Possible responses

| Http status code | Description                                                                                                                      |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| 201              | Secret created                                                                                                                   |
| 401              | Unauthorized, token verification needed. See: [Authentication](/docs/manage/getting-started/authentication) for more information |
| 403              | No permission for this organization                                                                                              |
| 422              | Error code: TooManyAppPasswords, Not allowed to add 3 passwords. You can only add a maximum of 2 passwords.                      |

#### Response body from 201 Created

| Property               | Explanation                                                                    | Type   | Notes |
| ---------------------- | ------------------------------------------------------------------------------ | ------ | ----- |
| **entityId**           | The id to identify the secret.                                                 | string |       |
| **metadata.clientId**  | The client id is used in the authentication to retrieve a jwt token.            | string |       |
| **metadata.apiSecret** | The api secret is used in the authentication to retrieve a jwt token.           | string |       |
| **metadata.expiresAt** | The date the secret expires and cannot be used to retrieve any more jwt tokens. | string |       |