Org

Mint a grant key against a grant (owner-only)

Owner-only. Mints a credential against exactly this grant for its agent/ci principal, NARROWED by scope/spend_cap/expires_at — never widened. A grant key is never an owner. For kind: run402_agent_key the key.token (the bearer to hand the agent) is returned ONCE. A grant may hold several keys. Takes the grant_key.issue step-up for a sign-in session. Audited.

post/projects/v1/{project_id}/grants/{grant_id}/keys

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/projects/v1/{project_id}/grants/{grant_id}/keys
  • Auth: API key in header SIGN-IN-WITH-X

Path parameters

project_idstring required
grant_idstring uuid required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

kind'tempo_access_key' | 'base_disposable_eoa' | 'run402_agent_key' | 'ci_oidc'

Defaults to run402_agent_key (the bearer an agent holds). erc7710 is forward-declared and rejected (501).

expires_atstring date-time nullable
public_subjectstring

Response

Grant key minted

statusstring
grant_idstring uuid

Changes

No recorded changes to this operation across all 1 revision of this API.