Agent Keys

Per-agent secrets for runtime identity verification.

Agents can have an optional api_key set at registration (POST /agents) or update (PATCH /agents/{id}). The key is stored as a SHA-256 hash with only the last 4 characters retained (api_key_last4).

Usage

bash

curl -X POST https://app.korclaw.com/api/v1/policy/evaluate \
  -H "Authorization: Bearer kc_live_xxx" \
  -H "X-KorClaw-Agent-Key: ka_your_agent_key_here" \
  -H "Content-Type: application/json" \
  -d '{"input":{"action":"deploy","agent":"ops-bot"}}'

When an agent has api_key_hash set, the X-KorClaw-Agent-Key header is required. Missing header returns agent_key_required (401); wrong key returns invalid_agent_key (401).