---
title: "Authorize a member to receive an immutable organization key"
method: POST
path: "/keys/member"
tags: ["Key Management"]
---

# Authorize a member to receive an immutable organization key

`POST /keys/member`

## Request

- Base URL: `https://app.arkova.ai/api/v1`
- URL: `https://app.arkova.ai/api/v1/keys/member`
- Auth: HTTP bearer

An active owner/admin authorizes an exact current member. No secret is returned. Reuse request_id only with the identical payload after an uncertain response. Authorization expires after 24 hours. For rotation, the old key remains usable until the intended member successfully claims its replacement. Rotation preserves the actor and organization. To change members, revoke the old key and authorize a new key without rotate_key_id. Claim rechecks issuer and member authority under database locks.

## Request body

- MemberKeyAuthorizationRequest
  - `request_id` string, uuid, required: Stable request UUID; changed-payload reuse returns 409.
  - `actor_user_id` string, uuid, required
  - `name` string, required
  - `scopes` string[], required
  - `expires_at` string, date-time, nullable: Optional absolute key expiry, validated at authorization and claim.
  - `rotate_key_id` string, uuid: Existing key for the same actor and organization to replace atomically at claim; creating authorization alone does not revoke it.

## Response `200`

Identical pending authorization already exists

- MemberKeyAuthorizationReceipt
  - `org_id` string, uuid, required
  - `issuer_user_id` string, uuid, required
  - `actor_user_id` string, uuid, required
  - `name` string, required
  - `scopes` string[], required
  - `key_expires_at` string, date-time, nullable, required
  - `expires_at` string, date-time, required
  - `state` 'pending', required
  - `old_key_id` string, uuid, nullable, required
  - `intent_id` string, uuid, required
  - `idempotent` boolean, required

## Other responses

- `201`: Pending authorization created
- `400`: Invalid request, workspace selector, or cursor
- `401`: Verified user session required; API keys cannot authorize or claim human credentials
- `403`: Inactive user, missing membership, insufficient administrator authority, or wrong claimant
- `409`: Expired or consumed authorization, conflicting request ID, or unavailable rotation. Repeated claims never replay a secret.
- `429`: Key creation budget reached; inspect Retry-After before another attempt
- `503`: Authority or persistence unavailable; no success or secret delivery is asserted. Refresh intent status before retrying.

---

[API](https://skmtc.dev/arkova/apis/arkova-verification-api.md) · [All operations](https://skmtc.dev/arkova/apis/arkova-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arkova/apis/arkova-verification-api/revisions/a14858d1efd4?raw)