---
title: "Mint a pre-authorized link key for the signed-in account"
method: POST
path: "/api/preauth-keys"
tags: ["nodes"]
---

# Mint a pre-authorized link key for the signed-in account

`POST /api/preauth-keys`

## Request

- Base URL: `https://app.nerdit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.nerdit.ai/api/preauth-keys`
- Auth: none declared

Issue one key, and hand back its plaintext exactly once (D-X16-O7/O8).

The audit row records the key's id, its lifetime and its fan-out, and
passes the plaintext as a forbidden value so that a future edit which
interpolated it into the metadata would fail loudly rather than ship a
readable enrollment credential in ``cloud_audit``.

## Request body

- PreauthKeyMintRequest: What an owner may choose about a key: a label, a fan-out, a lifetime. All three are optional, and the deployment's defaults (OD-10: one use, ninety days, unnamed) are what an empty body asks for — the common case is a single machine and should not require an owner to have an opinion. The upper bounds are *not* here: they are settings, so a static ``le=`` would be a second copy of a number an owner can ratify, and the two would drift. The policy layer refuses above the cap with the same ``400`` this model would have given.
  - `name` string, nullable
  - `max_uses` integer, nullable
  - `ttl_days` integer, nullable

## Response `201`

Successful Response

- PreauthKeyMintResponse: The one and only time a key's plaintext leaves this deployment. Nothing stores it, so this body is unrepeatable: a client that loses it revokes the key and mints another. The metadata beside it is what ``GET`` will keep answering, so a console can render the new row without a refetch.
  - `key` string, required
  - `id` string, uuid, required
  - `name` string, nullable, required
  - `max_uses` integer, required
  - `used_count` integer, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict
- `422`: Validation Error

---

[API](https://skmtc.dev/nerdit/apis/nerdit-cloud-web.md) · [All operations](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/llms.txt) · [OpenAPI document](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/revisions/06e3b44b58be?raw)