---
title: "Manage agent API key"
method: POST
path: "/v0.2.4/agents/api-key"
tags: ["Agents"]
---

# Manage agent API key

`POST /v0.2.4/agents/api-key`

Create, rotate, revoke, or delete the agent's API key. Each agent can have only one API key at a time.

## Request body

- object
  - `agentId` string, required — Agent UID
  - `subAccount` string — Sub-account identifier
  - `action` 'create' | 'rotate' | 'revoke' | 'delete' | 'update-webhook', required — - create: Generate initial API key - rotate: Replace existing key with new one - revoke: Mark key as revoked (keeps record, blocks usage) - delete: Permanently remove the key - update-webhook: Update webhook URL only
  - `appName` string — Name for the API key (required for create/rotate)
  - `webhookUrl` string, uri — Webhook URL for agent events (optional for create/rotate, required for update-webhook)

## Response `200`

Operation successful

- object
  - `status` string
  - `data` object — Returned for create/rotate actions
    - `id` string
    - `key` string
    - `secret` string — API key secret (shown only once)
    - `appName` string
    - `webhookUrl` string, nullable — Webhook URL for agent events
    - `createdAt` string
  - `message` string

## Other responses

- `400` — Validation error in the request.
- `401` — Access to this resource is not available for unauthenticated users.
- `403` — Access to this resource is forbidden.
- `404` — The requested resource was not found.
- `500` — Indicates an internal server error.

---

[API](https://skmtc.net/chimoney/apis/chimoney-api-docs.md) · [All operations](https://skmtc.net/chimoney/apis/chimoney-api-docs/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/chimoney/chimoney-api-docs/revisions/227751df36a0/schema)