Create a session key

Issue a time-bound, velocity-bound allowance scoped to a mandate: the credential an autonomous agent actually holds.

POST /v1/session-keys

cURL

curl https://api.openfi.co/v1/session-keys \
  -H "Authorization: Bearer $OPENFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mandate_id": "man_01HZY...",
    "expires_in": 86400
  }'

200

{
  "id": "sk_01HZZ...",
  "mandate_id": "man_01HZY...",
  "status": "active",
  "expires_at": "2026-08-28T14:05:00Z"
}

A session key is what gets handed to an AI agent or automated process. It is checked on every debit pull against the on-chain Allowance State Machine, so it can never authorize more than its parent mandate’s ceiling for the current epoch.

Body Parameters

mandate_id · string · required

The mandate this session key is scoped to.

expires_in · integer · required

Time-to-live in seconds. Common values: 3600 (1 hour), 86400 (1 day).

max_amount_override · number

Optional tighter ceiling for this specific key, must be ≤ the parent mandate’s max_amount.

restricted_destinations · array

Optional allow-list of destination addresses or account IDs this key may pay out to.

Response

id · string

Session key ID, prefixed sk_.

status · string

active, expired, or revoked.

cURL

curl https://api.openfi.co/v1/session-keys \
  -H "Authorization: Bearer $OPENFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mandate_id": "man_01HZY...",
    "expires_in": 86400
  }'

200

{
  "id": "sk_01HZZ...",
  "mandate_id": "man_01HZY...",
  "status": "active",
  "expires_at": "2026-08-28T14:05:00Z"
}

Revoking a session key

curl -X DELETE https://api.openfi.co/v1/session-keys/sk_01HZZ... \
  -H "Authorization: Bearer $OPENFI_API_KEY"

Revoking a session key does not affect the parent mandate or any other session keys issued under it.