Skip to main content
AXON supports three credential shapes on the Decision API. If neither a static operator key nor platform auth is configured, the daemon is misconfigured and will not start.
Hosted launch posture uses three different trust tiers on purpose: a wallet-scoped runtime key for agents, org-wide operator keys for control-plane automation, and Supabase sessions for human dashboard use. Do not hand AXON_DECISION_API_KEY to end users or agent runtimes.

​
Static Operator Key

Use AXON_DECISION_API_KEY for static operator access: admin routes, worker triggers, /v1/metrics, and static-key access to /v1/operator/mcp. Configuration:
Request header:

​
Database API Keys (axon_sk_*)

AXON can mint database-backed API keys through /v1/api-keys.
  • Wallet-scoped keys: runtime surface for /v1/mcp and wallet-bound REST calls.
  • Org-wide keys: operator automation surface for /v1/operator/mcp and org-scoped REST routes.
  • Scope enforcement applies only to database-backed keys; static operator keys are unrestricted.

​
Supabase Session Auth

When AXON_PLATFORM_AUTH_ENABLED=true, the daemon also accepts a Supabase user access token on supported platform routes. The daemon then:
  1. Validates the Supabase session
  2. Loads user_organizations
  3. Grants org-scoped access based on membership
Configuration:
Constraints:
  • User must exist in Supabase Auth
  • User must belong to the organization in user_organizations
  • In production, browser origin must be in AXON_PLATFORM_ALLOWED_ORIGINS or CORS rejects the request

​
Route/Auth Matrix

​
MCP Stdio Auth

The MCP server over stdio does not use HTTP bearer auth. Access control is provided by:
  • Local process/environment permissions
  • Runtime sandbox/tool allowlists in the agent host
The MCP process still needs backend secrets in its environment:
  • SUPABASE_SERVICE_KEY
  • MASTER_MNEMONIC (full-signing mode only)
  • BASE_RPC_URL
  • AGENT_WALLET_ID

​
OpenClaw Plugin

​
Dashboard API Keys

The dashboard page at /settings/api-keys is an organization-scoped key registry. It does not replace:
  • Daemon AXON_DECISION_API_KEY
  • Browser Supabase session auth
  • Runtime/operator surface separation

​
Common Auth Failures

  • Missing Authorization header
  • Invalid AXON_DECISION_API_KEY or revoked axon_sk_* key
  • AXON_PLATFORM_AUTH_ENABLED is off, so Supabase tokens are rejected
  • Session token is valid, but user has no user_organizations membership
Calling POST /v1/orgs/bootstrap with static bearer instead of a Supabase session token. Use the CLI bootstrap for headless setup.
  • Org was created via CLI and operator is missing a user_organizations row
  • Dashboard origin is not in AXON_PLATFORM_ALLOWED_ORIGINS
Daemon started without AXON_DECISION_API_KEY and without AXON_PLATFORM_AUTH_ENABLED=true.

​
Hardening Checklist

  • Keep AXON_DECISION_API_KEY in a secret manager, never in source control
  • Keep SUPABASE_SERVICE_KEY and MASTER_MNEMONIC out of browser code and agent transcripts
  • Restrict daemon network exposure
  • Avoid logging full auth headers
  • Rotate AXON_DECISION_API_KEY on compromise or environment changes