---
title: "Account Ensure Key"
method: POST
path: "/api/account/keys/ensure"
---

# Account Ensure Key

`POST /api/account/keys/ensure`

## Request

- Base URL: `https://opwhcervi3.execute-api.ca-central-1.amazonaws.com`
- URL: `https://opwhcervi3.execute-api.ca-central-1.amazonaws.com/api/account/keys/ensure`
- Auth: HTTP bearer

The one way to get an API key: POST /api/account/signup, then this call. The first call mints the account's key and returns it once (`created: true`, `key`). Any later call never rotates or revokes: it returns `has_key: true` and the prefix of the key that stays valid (`key` is null, since keys are stored hashed). Bearer authentication is required; it consumes no trial or quota and has no billing side effect.

## Headers

- `Authorization` string, nullable

## Response `200`

Successful Response

- AccountKeyEnsureResponse: Idempotent "make sure this account has a key" result. On the FIRST call (no active key) it mints one and returns the full secret exactly once (`created=True`). On any later call it reports the existing key's prefix without ever rotating it (`created=False`, `key=None`) -- so a page refresh can never silently replace a working key.
  - `created` boolean, required
  - `has_key` boolean
  - `key` string, nullable
  - `message` string, required
  - `prefix` string, nullable

## Other responses

- `401`: Missing, malformed, or invalid credentials.
- `422`: Validation Error

---

[API](https://skmtc.dev/dxpert/apis/dxpert-ai-api.md) · [All operations](https://skmtc.dev/dxpert/apis/dxpert-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dxpert/apis/dxpert-ai-api/revisions/460f1c8c53d1?raw)