apikey.created

Sent when a new API key is created for a project, from the dashboard’s API Key tab (or the equivalent API call) — see Authentication for how keys work.

Headers

Header	Description
X-Baiyar-Signature	t=<unix timestamp>,v1=<hex HMAC-SHA256> — see Verifying Webhook Signatures
Content-Type	application/json

Payload

{
  "id": "evt_TmwUkYbLQ2sVn7RdWX34",
  "type": "apikey.created",
  "created_at": "2026-09-16T04:03:46Z",
  "data": {
    "id": "01a0a63d-3db6-73fa-ab21-5861a54024e4",
    "name": "Webhook verification key",
    "environment": "sandbox",
    "project_id": "project_IChAi2NR4vzKN3SgEYPI",
    "key_prefix": "sk_test_",
    "created_at": "2026-09-16T04:03:46Z"
  }
}

Field	Type	Description
id	string	Unique event ID — use it to deduplicate retried deliveries, not data.id
type	string	Always apikey.created
created_at	date-time	When the event was generated
data.id	string	The API key’s ID
data.environment	string	sandbox or production
data.project_id	string	The project’s public ID
data.key_prefix	string	sk_test_ or sk_live_ — never the secret itself

data never includes the key’s secret or its hash — the secret is only ever shown once, in the dashboard, at creation time.

Testing

There’s no sandbox simulator for this event — trigger it by actually creating a sandbox API key from the dashboard and watching your endpoint receive the delivery within a few seconds.