Creates — or rotates — the caller's API key of the requested type and returns…
Creates — or rotates — the caller's API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.
POST /v1/account/keys
| Address | https://api.hanzo.ai/v1/account/keys |
| Method | POST |
| Operation | post_account_keys |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Creates — or rotates — the caller's API key of the requested type and returns it ONCE. A real IAM failure surfaces as 502, never a fabricated key.
Rotating is what creating means here: a user holds one key per type, so the endpoint is idempotent by (caller, type) and the superseded credential stops working. Two live secrets for one user would make "revoke my key" a lie.
Request
2 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
limit | body | string[] | — | Limit narrows what the minted key may reach, as kind:name entries: model:zen5, project:acme, product:commerce, or model:* for a whole kind. |
type | body | string | — | Type is the key class to act on: "secret" (sk-, session-equivalent, belongs on a server) or "publishable" (pk-, org-identifying, safe in a browser bundle). |
Response
| Status | Body | Meaning |
|---|---|---|
200 | mintedKey | ok |
200 body — 4 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
accessKey | body | string | — | AccessKey is the same value under its predecessor name, carried so callers written against the older field keep working. |
key | body | string | — | Key is the credential, returned ONCE — a secret key is unreadable afterwards. |
limit | body | string[] | — | Limit is what the minted key may reach, echoed back so the caller can see the narrowing took. |
type | body | string | — | Type is the class of key that was minted. |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, AccountApi } from 'hanzoai';
const api = new AccountApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postAccountKeys({ limit: ["<limit>"], type: "<type>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AccountApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AccountApi(client).post_account_keys(limit=["<limit>"], type="<type>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.AccountAPI.PostAccountKeys(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, account_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = account_api::post_account_keys(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AccountApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new AccountApi(client).postAccountKeys();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl -X POST https://api.hanzo.ai/v1/account/keys \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"limit": [
"<limit>"
],
"type": "<type>"
}'The door reaches account through the account tool, which names its 8 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_appearance"
}
}
}'How is this guide?