---
title: "Exchange an API key for a session"
method: POST
path: "/agentAuth"
tags: ["Agent Wallet"]
---

# Exchange an API key for a session

`POST /agentAuth`

## Request

- Base URL: `https://laso.finance`
- URL: `https://laso.finance/agentAuth`
- Auth: none declared

Exchanges a durable `lasoak_` API key for a short-lived `id_token` (one hour) plus a `refresh_token`, and returns an `auth_url` to hand your human so they can watch what you do. This is the first call an agent makes. The reply's `id_token` authenticates every other endpoint here.

If you have no key, your human creates one at https://laso.finance/agent/dashboard — there is no other way to obtain one.

Send the `id_token` from `/auth` as a Bearer token, with a plain JSON body (no `data` wrapper). Free.

## Request body

- object
  - `api_key` string, required: Your `lasoak_` API key.

## Response `200`

An id_token, a refresh_token, and an auth_url for your human.

- object

## Other responses

- `400`: A required field is missing or invalid.

---

[API](https://skmtc.dev/laso/apis/laso-finance-x402-api.md) · [All operations](https://skmtc.dev/laso/apis/laso-finance-x402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laso/apis/laso-finance-x402-api/revisions/e83fa3f023fa?raw)