curl -X POST 'https://api.github.com/repos/example-owner/example-repo/keys' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "key": "example-key"
}'

# POST /repos/{owner}/{repo}/keys (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create a deploy key

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/repos/example-owner/example-repo/keys' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "key": "example-key"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| key | body | string | Yes | The contents of the key. |
| title | body | string | No | A name for the key. |
| read_only | body | boolean | No | If `true`, the key will only be able to read repository contents. Otherwise,... |

## Response example
{"id":0,"key":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /repos/{owner}/{repo}/keys — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create a deploy key

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 284 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/repos/example-owner/example-repo/keys' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "key": "example-key"}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
title	body	string	No	A name for the key.
key	body	string	Yes	The contents of the key.
read_only	body	boolean	No	If `true`, the key will only be able to read repository contents. Otherwise, the key will be able to read and write. Deploy keys with write access can perform the same actions as an organization member with admin access, or a collaborator on a personal repository. For more information, see "[Repository permission levels for an organization](https://docs.github.com/articles/repository-permission-levels-for-an-organization/)" and "[Permission levels for a user account repository](https://docs.github.com/articles/permission-levels-for-a-user-account-repository/)."

Response 200 OK

{
  "id": 0,
  "key": "string",
  "url": "string",
  "title": "string",
  "verified": true,
  "created_at": "string",
  "read_only": true,
  "added_by": "string",
  "last_used": "2026-09-03T00:00:00Z",
  "enabled": true
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.