---
title: "Lease a short-lived Bankr wallet API key"
method: POST
path: "/v1/agents/{agent_id}/bankr-keys/lease"
tags: ["Bankr Keys"]
---

# Lease a short-lived Bankr wallet API key

`POST /v1/agents/{agent_id}/bankr-keys/lease`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/agents/{agent_id}/bankr-keys/lease`
- Auth: HTTP bearer

Provision a scoped, time-limited Bankr wallet API key for an agent.
**Privileged, deny-by-default:** agent callers need an explicit access policy
on `agents/{agent_id}/bankr/*` in the `__agent-keys` vault (JWT scope
`agents/{agent_id}/bankr/lease`). Agents may only lease for their own ID.
The `bk_usr_` key is **omitted** from the JSON response for agent JWTs —
stored server-side for Shroud resolution. Human callers receive `api_key` once.
Requires `BANKR_PARTNER_KEY` on Vault. Agent default TTL 15 min when omitted;
human/org default 1 hour (`BANKR_DEFAULT_LEASE_TTL_SECS`). Recommend 5–15 min
for autonomous agents. Max TTL 24 hours. Max 5 concurrent leases per agent.

## Path parameters

- `agent_id` string, uuid, required

## Request body

- LeaseBankrKeyRequest
  - `wallet_id` string: Bankr wallet ID (wlt_...). Uses org default if omitted.
  - `ttl_seconds` integer: Lease TTL in seconds (default 3600, max 86400).
  - `permissions` LeaseBankrPermissions
    - `llm_gateway_enabled` boolean
    - `agent_api_enabled` boolean
    - `read_only` boolean

## Response `201`

Bankr key leased

- LeaseBankrKeyResponse
  - `lease_id` string, uuid
  - `api_key` string: Ephemeral bk_usr_ key. Present for human callers only; omitted for agent JWTs.
  - `wallet_id` string
  - `expires_at` string, date-time

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)