Auth

List agent API keys

GET /api/v1/agent-keys

Keys owned by the signed-in user, each with the scopes it actually carries. The secret is never returned. Each key also carries rateLimit, the same budget the MCP endpoint publishes as X-RateLimit-*, so a client can show calls left and the reset instant without calling the key.

Responses

• 200 — The user’s keys. object
• 401 — Missing or invalid credential (session token or API key; only when auth is configured). Error
• 503 — Auth is not configured in this environment. Error

curl "$API_URL/api/v1/agent-keys" \
  -H "Authorization: Bearer $TOKEN"

Mint an agent API key

POST /api/v1/agent-keys

Creates a 90-day key owned by the signed-in user. scopes chooses the grant in the same vocabulary the PRM advertises: onboarding, accounting:read, accounting:write; a token grants exactly itself and accounting:write does not imply read. Omit scopes for the full read+write grant every key has had (onboarding and accounting). An unknown token is a 400 with code: "invalid_scope" and the supported list, never silently dropped; unknown body fields are rejected. The granted scopes are returned here and by GET /api/v1/agent-keys. The full key is returned once.

Request body (application/json)

Type: object

Responses

• 201 — The new key. The key field is shown only here. object
• 400 — Malformed request, or a scope outside the supported set. Error
• 401 — Missing or invalid credential (session token or API key; only when auth is configured). Error
• 503 — Auth is not configured in this environment. Error

curl -X POST "$API_URL/api/v1/agent-keys" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Revoke an agent API key

DELETE /api/v1/agent-keys/{id}

Deletes one of the signed-in user’s keys. Another user’s key is a 404.

Parameters

Responses

• 200 — Key revoked. Ok
• 401 — Missing or invalid credential (session token or API key; only when auth is configured). Error
• 404 — Key not found. Error
• 503 — Auth is not configured in this environment. Error

curl -X DELETE "$API_URL/api/v1/agent-keys/:id" \
  -H "Authorization: Bearer $TOKEN"

Current session

GET /api/v1/auth/me

The credential behind this request and the user it belongs to. via says which one it was: apiKey for an elk_ key (x-api-key or Authorization: Bearer elk_…), oauth for an OAuth access token, session for a signed-in session token. Any valid credential may call it, so this is the one route an agent key can reach before it holds a scope (#193).

Responses

• 200 — Authenticated. object
• 401 — Missing or invalid credential (session token or API key; only when auth is configured). Error
• 503 — Auth is not configured in this environment. Error

curl "$API_URL/api/v1/auth/me" \
  -H "Authorization: Bearer $TOKEN"

Schemas

Error

Ok