---
title: "Mint an agent API key"
method: POST
path: "/api/agents/keys"
tags: ["agents"]
---

# Mint an agent API key

`POST /api/agents/keys`

## Request

- Base URL: `https://api.depixapp.com`
- URL: `https://api.depixapp.com/api/agents/keys`
- Auth: none required

Mints an API key for the agent's own merchant. Auth is the agent keypair signature — the per-request proof-of-possession IS the step-up (no password). A LIVE key requires graduation (403 graduation_pending); a merchant_* scope requires a verified domain (403 domain_required); wallet_write keys get mandatory limits. Rejected when the merchant is suspended (403 account_suspended). Plaintext is returned ONCE.

## Request body

- AgentKeyCreateRequest: Mint an API key for the agent's own merchant. Authenticated by the agent keypair signature (no password step-up — the per-request signature IS the step-up).
  - `live` boolean: true → production sk_live_ (requires graduation); false/omitted → sandbox sk_test_.
  - `scopes` string[]: Any subset of the scope taxonomy. merchant_* scopes require a verified domain. Defaults to merchant_read+merchant_write.
  - `label` string, nullable: Optional human label (≤100 chars).
  - `per_tx_limit_cents` integer, nullable: Optional per-transaction cap. wallet_write keys get a mandatory default (10000) if unset.
  - `daily_limit_cents` integer, nullable: Optional rolling daily cap. wallet_write keys get a mandatory default (50000) if unset.

## Response `201`

Key minted — store the plaintext now; it is never shown again.

- AgentKeyCreateResponse: The minted key — plaintext returned ONCE.
  - `response` object, required: Envelope.
    - `id` string, required: Key id.
    - `key` string, required: The sk_live_/sk_test_ plaintext (one-time).
    - `prefix` 'sk_live_' | 'sk_test_', required: Key prefix.
    - `is_live` boolean, required: true for a production key.
    - `scopes` string, required: Space-separated granted scopes.
    - `per_tx_limit_cents` integer, nullable, required: Per-transaction cap (null if unbounded and not wallet_write).
    - `daily_limit_cents` integer, nullable, required: Rolling daily cap (null if unbounded and not wallet_write).

## Other responses

- `400`: Invalid scopes/label/limits, or the 5-key cap for this kind was reached.
- `401`: Signature chain failed or unknown agent key.
- `403`: Blocked (account_blocked), suspended (account_suspended), not graduated for a live key (graduation_pending), or missing a verified domain for a merchant_* scope (domain_required).
- `429`: Rate limited (per-IP, per-key or per-merchant window). Retry after `retry_after` seconds (also in the Retry-After header).
- `503`: Nonce anti-replay store unavailable (fail-CLOSED) OR the agent program is globally disabled (agents_disabled) — retry later.

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)