code: func (api OrganizationsAPI) CreateNewAPIKey(w http.ResponseWriter, r *http.Request) {
  	globalID := mux.Vars(r)["globalid"]
  
  	apiKey := APIKey{}
  
  	if err := json.NewDecoder(r.Body).Decode(&apiKey); err != nil {
  		log.Debug("Error decoding apikey: ", err)
  		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
  		return
  	}
  	apiKey.Secret = "dummysecret" // else the validator complains
  	if !apiKey.Validate() {
  		log.Debug("Invalid api key: ", apiKey)
  		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
  		return
  	}
  
  	log.Debug("Creating apikey:", apiKey)
  	c := oauthservice.NewOauth2Client(globalID, apiKey.Label, apiKey.CallbackURL, apiKey.ClientCredentialsGrantType)
  
  	mgr := oauthservice.NewManager(r)
  	err := mgr.CreateClient(c)
  	if db.IsDup(err) {
  		log.Debug("Duplicate label")
  		http.Error(w, http.StatusText(http.StatusConflict), http.StatusConflict)
  		return
  	}
  	if err != nil {
  		log.Error("Error creating api secret label", err.Error())
  		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  		return
  	}
  
  	apiKey.Secret = c.Secret
  
  	w.Header().Set("Content-Type", "application/json")
  
  	w.WriteHeader(http.StatusCreated)
  	json.NewEncoder(w).Encode(apiKey)
  
  }
docs: // CreateNewAPIKey is the handler for POST /organizations/{globalid}/apikeys
  // Create a new API Key, a secret itself should not be provided, it will be generated
  // serverside.