Webhook event

`api_key.created`

A key was created. The secret is never in an event.

Type: api_key.created
The object it carries: the api_key object
Subscribe with: api_key.created, api_key.* or *

Example payload

The body of the request your endpoint receives, shown here over several lines. On the wire it is compact JSON; check its signature over the bytes exactly as they arrive.

Example payload

{
  "id": "evt_sym2vzedapwwgjxepd1z65xn",
  "object": "event",
  "livemode": true,
  "created": "2026-09-03T09:50:00.000Z",
  "type": "api_key.created",
  "api_version": "2026-10-11",
  "data": {
    "object": {
      "id": "key_6e3gg2c6ea176xxdek2nar6v",
      "object": "api_key",
      "livemode": true,
      "created": "2026-09-03T09:50:00.000Z",
      "name": "Shop backend",
      "type": "restricted",
      "prefix": "sk_live_",
      "last4": "x9Tq",
      "scopes": [
        "checkout_sessions:write",
        "orders:read",
        "refunds:write",
        "events:read"
      ],
      "allowed_ips": [],
      "status": "active",
      "api_version": "2026-10-11",
      "created_by": {
        "type": "member",
        "id": "mem_ceh1wpzdrpk13cnpcjy9w0fa"
      },
      "last_used_at": null,
      "expires_at": null,
      "rolled_from": null
    }
  },
  "request": {
    "id": null,
    "idempotency_key": null
  },
  "pending_webhooks": 1
}

Fields of data.object

Fields of data.object in api_key.created
Field	In this example
`id`	`"key_6e3gg2c6ea176xxdek2nar6v"`
`object`	`"api_key"`
`livemode`	`true`
`created`	`"2026-09-03T09:50:00.000Z"`
`name`	`"Shop backend"`
`type`	`"restricted"`
`prefix`	`"sk_live_"`
`last4`	`"x9Tq"`
`scopes`	A list of 4 items
`allowed_ips`	A list of 0 items
`status`	`"active"`
`api_version`	`"2026-10-11"`
`created_by`	An object with `type`, `id`
`last_used_at`	`null`
`expires_at`	`null`
`rolled_from`	`null`

What each field means is on the page of the api_key object. This event carries no data.previous_attributes.

Endpoints behind it

Calls that change merchant, team and keys. An event is also sent when a payer, the network, a timer or a person in the dashboard causes the change; the sentence above says which.