Create an API key | Outlap Docs

Most people create keys in the app: see Create an API key. This endpoint is what the app calls, and it’s useful for admin tooling that already holds a signed-in club admin’s session.

Unlike every other endpoint, it authenticates with the user’s session token (a Supabase JWT) in the Authorization header, not with an API key. The caller must be an admin of the club.

Body

club_id string required

The club or track to create the key for.
name string required

A label so you can recognise the key later, such as “Race Control PC”.

Response

id string

Key ID, used for revocation and audit.
name string

The label you gave it.
key_prefix string

First eight characters, shown in the key list.
created_at string

ISO 8601 creation time.
key string

The full key: olap_ followed by 48 hex characters. Shown only in this response.

New keys carry the timing:write and timing:read scopes.

Errors

Status	`error`	Cause
`400`	`club_id and name required`	A field is missing.
`401`	`unauthorized`	No valid user session in `Authorization`.
`403`	`must be a club admin`	The signed-in user isn’t an admin of that club.
`405`	`method not allowed`	Only `POST` is supported.

curl -X POST https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api-key-create \
  -H "Authorization: Bearer $USER_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "club_id": "CLUB_ID", "name": "Race Control PC" }'

const res = await fetch("https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api-key-create", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${userAccessToken}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ club_id: clubId, name: "Race Control PC" }),
});
const { key } = await res.json(); // store it now; it won't be shown again

{
  "id": "5d1a…",
  "name": "Race Control PC",
  "key_prefix": "olap_3f9",
  "created_at": "2026-10-20T09:12:41.000Z",
  "key": "olap_3f9a1c…"
}

{ "error": "must be a club admin" }