Create keys
Creates — or rotates — the caller's API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.
POST /v1/account/keys
| Address | https://api.hanzo.ai/v1/account/keys |
| Method | POST |
| Operation | post_account_keys |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Creates — or rotates — the caller's API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.
Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make "revoke my key" a lie.
Request
2 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
limit | body | string[] | — | Limit narrows what the minted key may reach, as kind:name entries: model:zen5, project:acme, product:commerce, or model:* for a whole kind. |
type | body | string | — | Type is the key class to act on: "secret" (sk-, session-equivalent, belongs on a server) or "publishable" (pk-, org-identifying, safe in a browser bundle). |
Response
| Status | Body | Meaning |
|---|---|---|
200 | mintedKey | ok |
200 body — 4 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
accessKey | body | string | — | AccessKey is the same value under its predecessor name, carried so callers written against the older field keep working. |
key | body | string | — | Key is the credential, returned ONCE — a secret key is unreadable afterwards. |
limit | body | string[] | — | Limit is what the minted key may reach, echoed back so the caller can see the narrowing took. |
type | body | string | — | Type is the class of key that was minted. |
Failure carries the platform error shape — see Errors.
Examples
hanzo account keys createimport { Configuration, AccountApi } from 'hanzoai';
const api = new AccountApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postAccountKeys({ limit: ["<limit>"], type: "<type>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AccountApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AccountApi(client).post_account_keys(limit=["<limit>"], type="<type>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.AccountAPI.PostAccountKeys(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, account_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = account_api::post_account_keys(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AccountApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new AccountApi(client).postAccountKeys();curl -X POST https://api.hanzo.ai/v1/account/keys \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"limit": [
"<limit>"
],
"type": "<type>"
}'MCP reaches account through the account tool, which names its 8 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_appearance"
}
}
}'How is this guide?