Mint Phantom Token

POST /admin/ai-gateway/{gatewayId}/agents/{agentId}/keys

This is a control-plane endpoint on the admin host (e.g. admin.knoxcall.com). It is authenticated with a session JWT plus the X-Tenant-ID header and requires an owner or admin role — not an API key. It does not use the api.knoxcall.com API-key auth described in the shared Authentication section.

Request body

{
  "name": "CI pipeline token",
  "dpop_required": false
}

Both fields are optional. name defaults to key-<timestamp> if omitted, and dpop_required defaults to false. The token kind is always agent, and its scope (providers and models) is derived automatically from the agent’s configured default_model — it is not accepted from the request body. Response

{
  "key": {
    "id": "7f3c1e8a-2b4d-4f6a-9c1e-0a2b4d6f8c1e",
    "name": "CI pipeline token",
    "prefix": "kc_live_a_xx",
    "token": "kc_live_a_...",
    "dpop_required": false
  },
  "message": "Save this token now. It will not be shown again."
}

key.id is the phantom token’s UUID. key.prefix is the first 12 characters of the generated token (kc_live_a_ followed by two of its random hex characters).

The raw key.token value is returned exactly once — at minting time. KnoxCall stores only a sha256 hash. Save it to your secrets manager immediately.

Create Agent

Revoke Phantom Token

Overview

Routes

Secrets

Clients

Environments

API Keys

Webhooks

Ephemeral Proxy

AI Gateway

Audit Logs

Account

Tenant KMS

Secret Store Migrations

Mint Phantom Token

Mint phantom token

​Mint phantom token

Mint phantom token