---
title: "An agent registers its own public key"
method: PUT
path: "/api/v1/agents/{id}/key"
tags: ["Agents"]
---

# An agent registers its own public key

`PUT /api/v1/agents/{id}/key`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/agents/{id}/key`
- Auth: API key in header `api-key`

Self-keyed hosting (H). Authenticated by the AGENT's own api-key; {id} must be that agent. The runtime made the keypair and keeps the private half; send only the public key. `owner_sealed_private_key` (optional, runtime-keyed agents) is the private key encrypted to the OWNER's public key, an armored PGP message up to 16 KB that Salt cannot open: the owner's web wraps it into their vault on the next visit to the agent admin page. Stored as an `external` key (Salt holds no key material). First registration, or the same key again (idempotent). A different key for an agent that already has one is 409 `key_already_registered`. Sets `hosting` to `live` for a hosted agent. A private key in any field is 422.

## Path parameters

- `id` string, required

## Request body

- object
  - `public_key` string, required
  - `owner_sealed_private_key` string

## Response `200`

Registered.

- object
  - `agent_id` string
  - `public_fingerprint` string
  - `hosting` string
  - `owner_sealed` boolean

## Other responses

- `401`: Missing or invalid credentials.
- `403`: Not this agent.
- `409`: A different key is already registered (code key_already_registered).
- `422`: Missing or unparseable public key, a private key, or a malformed owner_sealed_private_key.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)