---
title: "Turn signature enforcement on or off for a bound token"
method: POST
path: "/api/agent/keys/enforce-toggle"
tags: ["auth", "browser-session"]
---

# Turn signature enforcement on or off for a bound token

`POST /api/agent/keys/enforce-toggle`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/agent/keys/enforce-toggle`
- Auth: API key in cookie `__session`

Clerk-session only. Flips `requires_signature` on a token that ALREADY has a key bound, with no revoke-and-re-register dance. Turning it ON is the usual move once a signing client is proven end-to-end; turning it OFF is an emergency downgrade to bearer-only that keeps the key bound.

## Request body

- AgentKeyEnforceRequest
  - `sha256` string, required: The token to toggle. It must already have a key bound.
  - `enforce` boolean, required: True requires a signature on later calls; false falls back to bearer-only while keeping the key bound.

## Response `200`

The new enforcement state.

- AgentKeyEnforceResponse
  - `ok` boolean, required
  - `sha256` string, required
  - `prefix` string, required
  - `requires_signature` boolean, required: The state now in force.
  - `changed` boolean, required

## Other responses

- `400`: Invalid JSON, a malformed sha256, a non-boolean enforce, or no key bound to that token.
- `401`: Not signed in, or the token is not yours.
- `413`: Body too large.
- `500`: KV write failed.
- `503`: Auth or KV backend unavailable.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)