---
title: "Mint an agent API key"
method: POST
path: "/agents/{agentId}/key"
tags: ["Agents"]
---

# Mint an agent API key

`POST /agents/{agentId}/key`

## Request

- Base URL: `https://app.arkova.ai/api/v1`
- URL: `https://app.arkova.ai/api/v1/agents/{agentId}/key`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`
  - HTTP bearer

JWT callers must be organization admins. API keys require agents:manage and must satisfy every scope allowed to the target agent. Returns the raw key once; mutations are not automatically retried.

## Path parameters

- `agentId` string, uuid, required

## Response `201`

Raw agent key returned once

- AgentKeyCreated
  - `key` string, required: Returned once and never persisted raw.
  - `key_id` string, uuid, required
  - `key_prefix` string, required
  - `agent_id` string, uuid, required
  - `agent_name` string, required
  - `scopes` string[], required
  - `created_at` string, date-time, required
  - `warning` string, required

## Other responses

- `401`: Missing, malformed, invalid, revoked, or expired credential
- `403`: Role, agents:manage, tenant, delegation, or provider scope ceiling denied
- `404`: Agent not found in caller tenant
- `409`: Ambiguous credentials or an inactive agent blocks key creation
- `503`: Lifecycle mutation temporarily unavailable; the client may retry after the indicated delay but must not retry automatically

---

[API](https://skmtc.dev/arkova/apis/arkova-verification-api.md) · [All operations](https://skmtc.dev/arkova/apis/arkova-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arkova/apis/arkova-verification-api/revisions/a14858d1efd4?raw)