# Create a key for a script

> For scripts only. Creates a key without a password, so this account cannot sign in to the dashboard until the email is verified and a password is set from /account/recover; a person wanting the dashboard should use /free-api-key (POST /v1/accounts/register) instead.

- **Endpoint**: `POST /v1/accounts/free`
- **Cost**: free, no key needed
- **Minimum plan**: free
- **Cache-Control**: `no-store`

Source: https://pokemontcgapi.com/docs/api/accounts/free

No key yet? One call gets you one: `POST /v1/accounts/free` with an `Idempotency-Key` header and your email address returns a working key in the response. Keep the original Idempotency-Key and body for response replay for up to 24 hours, under the conditions in the quickstart. The trial is 800 credits over 30 days once the address is confirmed, no card; paid plans start at 29 € a month. See the [quickstart](https://pokemontcgapi.com/docs/quickstart) and the [pricing](https://pokemontcgapi.com/pricing).

For scripts only. Creates a key without a password, so this account cannot sign in to the dashboard until the email is verified and a password is set from /account/recover; a person wanting the dashboard should use /free-api-key (POST /v1/accounts/register) instead.

For dashboard access, [create an account in the browser](https://pokemontcgapi.com/free-api-key). For script setup and the full replay conditions, follow the [quickstart](https://pokemontcgapi.com/docs/quickstart).

Save data.key.secret. If the response is lost, replay the same Idempotency-Key and body from the same network within 24 hours, under the quickstart conditions. The response excerpt below shows only the key secret; other account, key and quota fields are omitted.

## Body fields

| Name | Type | Default | Description |
| --- | --- | --- | --- |
| `email` **required** | string | — | The address to verify for this account. |

## Headers

| Name | Type | Default | Description |
| --- | --- | --- | --- |
| `Idempotency-Key` **required** | string | — | Generate once per signup and keep it with the exact request body for retries. |

## Example request

```bash
IDEM=$(uuidgen)
curl -s -X POST "https://api.pokemontcgapi.com/v1/accounts/free" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $IDEM" \
  -d '{"email":"you@example.com"}'
```

## Example response

`201 OK` · `Cache-Control: no-store`

`response.json`

```json
{"data":{"key":{"secret":"ptcg_live_example"}}}
```

## Errors

Every error body carries `error.code`, `error.message` and `error.request_id`. Switch on the code, never on the message.

| Status | Code | When |
| --- | --- | --- |
| 400 | `INVALID_PARAMETER` | A query parameter has the wrong type or an unsupported value — a non-integer `limit`, an unknown `lang`, an unknown `region`, a sort key that is not sortable. |

The full taxonomy, with what to do about each code, is on the [errors](https://pokemontcgapi.com/docs/errors) page.

A new signup for the same email returns 409 ACCOUNT_EXISTS. Reusing an Idempotency-Key with a different body returns 409 IDEMPOTENCY_CONFLICT.