---
title: "DEPRECATED alias of POST /api/credits/pickup"
method: POST
path: "/api/zai-keys/reveal"
tags: ["keys", "browser-session"]
deprecated: true
---

# DEPRECATED alias of POST /api/credits/pickup

`POST /api/zai-keys/reveal`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/zai-keys/reveal`
- Auth: API key in cookie `__session`

> **Deprecated.**

Deprecated 2026-09-15 (IC Credits rename); removed one release later. A thin re-export of POST /api/credits/pickup: the same atomic once-only claim and the same 410 dead-body. Move to the new path.

## Request body

- ZaiKeyRevealRequest
  - `request_id` string, required: The approved request to claim.

## Response `200`

Same as POST /api/credits/pickup.

- ZaiKeyRevealResponse
  - `ok` boolean, required
  - `request_id` string, required
  - `agent_token` string, required: The plaintext key. Surfaced EXACTLY ONCE; store it now; a second call returns 410.
  - `bundle` object: Ready-to-paste client configuration for the key.
  - `expires_at` string, date-time: When the key itself stops working (not the pickup window).

## Other responses

- `400`: Invalid JSON or missing request_id.
- `401`: Not signed in.
- `410`: Pickup window closed or unknown.
- `500`: Auth check failed.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)