diff --git a/module/Rest/src/Action/ShortUrl/CreateShortUrlAction.php b/module/Rest/src/Action/ShortUrl/CreateShortUrlAction.php
index 97097808..af6b3ecf 100644
--- a/module/Rest/src/Action/ShortUrl/CreateShortUrlAction.php
+++ b/module/Rest/src/Action/ShortUrl/CreateShortUrlAction.php
@@ -8,6 +8,8 @@ use Psr\Http\Message\ServerRequestInterface as Request;
 use Shlinkio\Shlink\Core\Exception\ValidationException;
 use Shlinkio\Shlink\Core\Model\CreateShortUrlData;
 use Shlinkio\Shlink\Core\Model\ShortUrlMeta;
+use Shlinkio\Shlink\Core\Validation\ShortUrlMetaInputFilter;
+use Shlinkio\Shlink\Rest\Authentication\Plugin\ApiKeyHeaderPlugin;
 
 class CreateShortUrlAction extends AbstractCreateShortUrlAction
 {
@@ -19,14 +21,16 @@ class CreateShortUrlAction extends AbstractCreateShortUrlAction
      */
     protected function buildShortUrlData(Request $request): CreateShortUrlData
     {
-        $postData = (array) $request->getParsedBody();
-        if (! isset($postData['longUrl'])) {
+        $payload = (array) $request->getParsedBody();
+        if (! isset($payload['longUrl'])) {
             throw ValidationException::fromArray([
                 'longUrl' => 'A URL was not provided',
             ]);
         }
 
-        $meta = ShortUrlMeta::fromRawData($postData);
-        return new CreateShortUrlData($postData['longUrl'], (array) ($postData['tags'] ?? []), $meta);
+        $payload[ShortUrlMetaInputFilter::API_KEY] = $request->getHeaderLine(ApiKeyHeaderPlugin::HEADER_NAME);
+        $meta = ShortUrlMeta::fromRawData($payload);
+
+        return new CreateShortUrlData($payload['longUrl'], (array) ($payload['tags'] ?? []), $meta);
     }
 }
diff --git a/module/Rest/src/Action/ShortUrl/SingleStepCreateShortUrlAction.php b/module/Rest/src/Action/ShortUrl/SingleStepCreateShortUrlAction.php
index 46385556..fe8c44aa 100644
--- a/module/Rest/src/Action/ShortUrl/SingleStepCreateShortUrlAction.php
+++ b/module/Rest/src/Action/ShortUrl/SingleStepCreateShortUrlAction.php
@@ -7,7 +7,9 @@ namespace Shlinkio\Shlink\Rest\Action\ShortUrl;
 use Psr\Http\Message\ServerRequestInterface as Request;
 use Shlinkio\Shlink\Core\Exception\ValidationException;
 use Shlinkio\Shlink\Core\Model\CreateShortUrlData;
+use Shlinkio\Shlink\Core\Model\ShortUrlMeta;
 use Shlinkio\Shlink\Core\Service\UrlShortenerInterface;
+use Shlinkio\Shlink\Core\Validation\ShortUrlMetaInputFilter;
 use Shlinkio\Shlink\Rest\Service\ApiKeyServiceInterface;
 
 class SingleStepCreateShortUrlAction extends AbstractCreateShortUrlAction
@@ -32,19 +34,23 @@ class SingleStepCreateShortUrlAction extends AbstractCreateShortUrlAction
     protected function buildShortUrlData(Request $request): CreateShortUrlData
     {
         $query = $request->getQueryParams();
+        $apiKey = $query['apiKey'] ?? '';
+        $longUrl = $query['longUrl'] ?? null;
 
-        if (! $this->apiKeyService->check($query['apiKey'] ?? '')) {
+        if (! $this->apiKeyService->check($apiKey)) {
             throw ValidationException::fromArray([
                 'apiKey' => 'No API key was provided or it is not valid',
             ]);
         }
 
-        if (! isset($query['longUrl'])) {
+        if ($longUrl === null) {
             throw ValidationException::fromArray([
                 'longUrl' => 'A URL was not provided',
             ]);
         }
 
-        return new CreateShortUrlData($query['longUrl']);
+        return new CreateShortUrlData($longUrl, [], ShortUrlMeta::fromRawData([
+            ShortUrlMetaInputFilter::API_KEY => $apiKey,
+        ]));
     }
 }
diff --git a/module/Rest/test/Action/ShortUrl/CreateShortUrlActionTest.php b/module/Rest/test/Action/ShortUrl/CreateShortUrlActionTest.php
index fd26da99..91e6014c 100644
--- a/module/Rest/test/Action/ShortUrl/CreateShortUrlActionTest.php
+++ b/module/Rest/test/Action/ShortUrl/CreateShortUrlActionTest.php
@@ -48,7 +48,7 @@ class CreateShortUrlActionTest extends TestCase
      * @test
      * @dataProvider provideRequestBodies
      */
-    public function properShortcodeConversionReturnsData(array $body, ShortUrlMeta $expectedMeta): void
+    public function properShortcodeConversionReturnsData(array $body, ShortUrlMeta $expectedMeta, ?string $apiKey): void
     {
         $shortUrl = new ShortUrl('');
         $shorten = $this->urlShortener->shorten(
@@ -58,6 +58,10 @@ class CreateShortUrlActionTest extends TestCase
         )->willReturn($shortUrl);
 
         $request = ServerRequestFactory::fromGlobals()->withParsedBody($body);
+        if ($apiKey !== null) {
+            $request = $request->withHeader('X-Api-Key', $apiKey);
+        }
+
         $response = $this->action->handle($request);
 
         self::assertEquals(200, $response->getStatusCode());
@@ -77,8 +81,14 @@ class CreateShortUrlActionTest extends TestCase
             'domain' => 'my-domain.com',
         ];
 
-        yield [['longUrl' => 'http://www.domain.com/foo/bar'], ShortUrlMeta::createEmpty()];
-        yield [$fullMeta, ShortUrlMeta::fromRawData($fullMeta)];
+        yield 'no data' => [['longUrl' => 'http://www.domain.com/foo/bar'], ShortUrlMeta::createEmpty(), null];
+        yield 'all data' => [$fullMeta, ShortUrlMeta::fromRawData($fullMeta), null];
+        yield 'all data and API key' => (static function (array $meta): array {
+            $apiKey = 'abc123';
+            $meta['apiKey'] = $apiKey;
+
+            return [$meta, ShortUrlMeta::fromRawData($meta), $apiKey];
+        })($fullMeta);
     }
 
     /**
diff --git a/module/Rest/test/Action/ShortUrl/SingleStepCreateShortUrlActionTest.php b/module/Rest/test/Action/ShortUrl/SingleStepCreateShortUrlActionTest.php
index d7b432c2..62005c8d 100644
--- a/module/Rest/test/Action/ShortUrl/SingleStepCreateShortUrlActionTest.php
+++ b/module/Rest/test/Action/ShortUrl/SingleStepCreateShortUrlActionTest.php
@@ -78,7 +78,7 @@ class SingleStepCreateShortUrlActionTest extends TestCase
                 return $argument;
             }),
             [],
-            ShortUrlMeta::createEmpty(),
+            ShortUrlMeta::fromRawData(['apiKey' => 'abc123']),
         )->willReturn(new ShortUrl(''));
 
         $resp = $this->action->handle($request);