---
title: "Claim the once-only plaintext key for a QUEUED request an operator approved"
method: POST
path: "/api/credits/pickup"
tags: ["keys", "browser-session"]
---

# Claim the once-only plaintext key for a QUEUED request an operator approved

`POST /api/credits/pickup`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/credits/pickup`
- Auth: API key in cookie `__session`

Clerk-session only (NOT reachable with an agt_ bearer). Only for a request that QUEUED (an instant mint returned its key in the request response). Call after /status flips to `approved`. The plaintext is surfaced EXACTLY ONCE; the claim is atomic, so a live key never double-dispenses. Every dead outcome (no stash, expired, not yours, already consumed, lost the race) collapses to one identical 410. The stash window is ~15 minutes; a member who misses it regenerates instead.

## Request body

- ZaiKeyRevealRequest
  - `request_id` string, required: The approved request to claim.

## Response `200`

The plaintext key, surfaced once.

- ZaiKeyRevealResponse
  - `ok` boolean, required
  - `request_id` string, required
  - `agent_token` string, required: The plaintext key. Surfaced EXACTLY ONCE; store it now; a second call returns 410.
  - `bundle` object: Ready-to-paste client configuration for the key.
  - `expires_at` string, date-time: When the key itself stops working (not the pickup window).

## Other responses

- `400`: Invalid JSON or missing request_id.
- `401`: Not signed in.
- `410`: Pickup window closed or unknown, identical for every dead outcome.
- `500`: Auth check failed.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)