Create API Key

curl --request POST \
  --url https://api.example.com/v1/api-keys

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/api-keys"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

POST

api-keys

Create API Key

curl --request POST \
  --url https://api.example.com/v1/api-keys

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/api-keys"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Mint a new axon_sk_* API key for an organization. The server generates the plaintext, HMAC-hashes it with the AXON_API_KEY_HASH_PEPPER (the same hash function verifyDatabaseApiKey uses on the read side), stores only the hash in api_keys, and returns the plaintext exactly once.

This route replaces the dashboard’s previous client-side hashing path, which was broken because the dashboard and the verifier used different hash functions. All new keys — dashboard-issued or CLI-issued — now flow through POST /v1/api-keys so they are verifiable on the read side.

Authentication

This is an operator-surface route. Accepted callers:

A Supabase JWT with owner or admin membership on organization_id
An org-wide tenant API key with write scope on the same organization
A wallet-bound tenant API key with write scope, but only when minting another key for that same wallet
The static operator key

POST /v1/api-keys
Authorization: Bearer <jwt-or-admin-api-key>
Content-Type: application/json

Request Body

Field	Type	Required	Description
`organization_id`	`string (uuid)`	Yes	Org that will own the new key
`name`	`string`	Yes	Human-readable label shown in the dashboard and audit log
`scopes`	`string[]`	No	Defaults to `["read", "write"]`. Must be a non-empty array when present.
`wallet_id`	`string (uuid) \| null`	No	Bind the key to a single wallet. Omit or send `null` to create an org-wide tenant key.

curl -X POST https://api.axon402.com/v1/api-keys \
  -H "Authorization: Bearer $AXON_ADMIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "organization_id": "2f1a...-...",
    "name": "ci-automation",
    "scopes": ["read", "write"],
    "wallet_id": null
  }'

Response

Success (`201 Created`)

{
  "id": "uuid",
  "plaintext": "axon_sk_...",
  "prefix": "axon_sk_xxxxxxxxxxxx",
  "organization_id": "uuid",
  "wallet_id": null,
  "name": "ci-automation",
  "scopes": ["read", "write"],
  "created_at": "2026-04-08T00:00:00.000Z",
  "connect_snippets": {
    "recommended": "...",
    "claude_code": "...",
    "json_config": "...",
    "agent_prompt": "...",
    "claude_skill": "..."
  },
  "mcp_url": "https://api.axon402.com/v1/mcp",
  "operator_mcp_url": "https://api.axon402.com/v1/operator/mcp"
}

The plaintext field is returned exactly once and is never logged. Store it immediately in a secret manager (or in ~/.axon/operator.json for @axon402/cli auth login). Lost the key? Rotate: create a new one and deactivate the old one.

Response Fields

Field	Type	Description
`id`	`string`	UUID of the new `api_keys` row
`plaintext`	`string`	The full `axon_sk_*` token. Returned once, never logged, not retrievable later.
`prefix`	`string`	Deterministic, low-entropy prefix of the key. Safe to display in UI listings so operators can identify which key is which.
`organization_id`	`string`	The owning org (echo of the request)
`wallet_id`	`string \| null`	The bound wallet if this is a wallet-scoped key; `null` for org-wide tenant keys
`name`	`string`	Echo of the request `name`
`scopes`	`string[]`	Echo of the request `scopes` (or the `["read","write"]` default)
`created_at`	`string`	ISO-8601 timestamp of insertion
`connect_snippets`	`object`	Copy-paste onboarding snippets for the minted runtime key
`mcp_url`	`string`	Canonical runtime MCP endpoint for the minted key
`operator_mcp_url`	`string \| null`	Canonical operator MCP endpoint. Present only for org-wide keys.

Errors

`400 VALIDATION_ERROR`

Returned when:

organization_id is missing or not a valid UUID
name is missing or empty
scopes is present but empty
wallet_id is present but belongs to a different organization

`403 REJECTED_POLICY`

The caller is authenticated but cannot mint the requested key. Common causes:

wallet-bound key trying to mint an org-wide key
wallet-bound key trying to mint a key for a different wallet
caller lacks write authority on organization_id

`404 NOT_FOUND`

wallet_id was supplied but does not exist (or the caller cannot see it).

Hash function

The server stores HMAC-SHA256(plaintext, AXON_API_KEY_HASH_PEPPER) — never the plaintext itself. The pepper lives in Cloud Run’s Secret Manager and is not accessible from the database. A DB leak alone is not enough to reverse or brute-force a stored key. verifyDatabaseApiKey (the function that runs on every authenticated request) uses the same HMAC function, which is why all new keys must be issued through this server-side route — client-side hashing with a different function would produce unverifiable keys (the bug that motivated this route’s creation, see CHANGELOG 2026-04-08).

Overview

Onboarding

Core Spend

Approvals

Organizations

Treasury

Providers

Discovery

Workers & Observability

MCP Tools

Reference

Create API Key

Authentication

Request Body

Response

Success (`201 Created`)

Response Fields

Errors

`400 VALIDATION_ERROR`

`403 REJECTED_POLICY`

`404 NOT_FOUND`

Hash function

See also

​Authentication

​Request Body

​Response

​Success (201 Created)

​Response Fields

​Errors

​400 VALIDATION_ERROR

​403 REJECTED_POLICY

​404 NOT_FOUND

​Hash function

​See also

Authentication

Request Body

Response

Success (`201 Created`)

Response Fields

Errors

`400 VALIDATION_ERROR`

`403 REJECTED_POLICY`

`404 NOT_FOUND`

Hash function

See also