> For the complete documentation index, see [llms.txt](https://docs.dispach.moeenmahmud.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispach.moeenmahmud.com/reference/http/dispach-agent-server/mint-an-operator-key-the-secret-is-returned-once-and-never-again.md).

# Mint an operator key. The secret is returned once and never again.

```json
{"openapi":"3.1.0","info":{"title":"Dispach agent server","version":"0.1.3"},"servers":[{"url":"http://localhost:7420","description":"Local server. Replace this with the URL of your deployment."}],"security":[{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"An operator key or the configured token."}}},"paths":{"/v1/keys":{"post":{"summary":"Mint an operator key. The secret is returned once and never again.","responses":{"201":{"description":"minted"},"401":{"description":"No credential, or one this server does not accept."}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"label":{"type":"string","code":"key_label_required","hint":"Send { \"label\": \"my browser\" }. A label is required rather than defaulted because it is the only thing distinguishing two credentials in a listing, and \"key 2\" is a name nobody can act on when deciding which to revoke.","description":"How this credential is shown in a listing. Required; see `keyLabelProblem`."},"scope":{"code":"key_scope_invalid","hint":"Send { \"scope\": { \"agents\": [\"milo\"], \"can\": [\"chat\"] } }, or omit it entirely for a key that reaches everything — which is what every key minted before scopes existed does.","description":"Opt-in narrowing. Absent is an unscoped key.","type":"object","properties":{"agents":{"code":"key_scope_agents_invalid","hint":"Send { \"agents\": [\"milo\"] } — a list of agent ids. Omit it for a key that reaches every agent. An id naming no agent on this server is reported rather than silently matching nothing.","description":"Agent ids this key may reach. Absent means all of them.","type":"array","items":{"type":"string","minLength":1}},"sessions":{"code":"key_scope_sessions_invalid","hint":"Send { \"sessions\": \"team_42:\" } — a session-key prefix, with an optional trailing \"*\". A prefix rather than a list, because the conversations this key will cover do not exist yet when it is minted.","description":"Session-key prefix. Absent means every session.","type":"string","minLength":1},"can":{"code":"key_scope_can_invalid","hint":"Send { \"can\": [\"chat\", \"read\"] }. The four are read (every GET), chat (send a message, answer an approval, stop a turn), write (schedules, phase, clearing a session) and admin (keys, provisioning, start/stop/reload). Absent means all four; an empty array means none, and is honoured as written.","description":"Capabilities this key may exercise. Absent means all four.","type":"array","items":{"type":"string","enum":["read","chat","write","admin"]}},"expiresIn":{"code":"key_scope_expires_invalid","hint":"Send { \"expiresIn\": 3600 } — whole seconds from now, as a number. Relative rather than an absolute instant, because that would need the caller and this server to agree about the clock; the response reports the absolute expiresAt this server computed.","description":"Seconds until this key stops authenticating. Absent means never.","type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}}}},"required":["label"]}}}}}}}}
```