Changelog

Summary

Register scoped P-256 credentials while keeping private key material in your own keystore. Agents can use independently managed keys with permissions and expiry appropriate to their work.

What’s new?

Register and manage public-key credentials through the API Keys endpoints:

• POST /v0/api-keys with public_key: register a public P-256 JWK. Use /v0/pods/{pod_id}/api-keys or /v0/inboxes/{inbox_id}/api-keys to select a pod or inbox scope.
• GET /v0/api-keys?type=public_key: list public-key credentials.
• GET /v0/api-keys/{api_key_id}: inspect a credential.
• PATCH /v0/api-keys/{api_key_id}: change its name or permissions.
• DELETE /v0/api-keys/{api_key_id}: revoke a credential. List and delete keys individually for multiple revocations.

Use cases

Build agents that:

• Keep private keys in a trusted keystore
• Use credentials scoped to an organization, pod, or inbox
• Rotate credentials by registering and verifying a replacement before deleting the old key