<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
Source of truth: the cobra command definitions in cmd/axiom/cmd/.
Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->
axiom app-key
Manage invoke-scoped app keys (public browser credentials)
Manage invoke-scoped app keys: PUBLIC, long-lived credentials a browser app ships in its bundle, restricted to a fixed set of flows (graph IDs) with an origin allowlist and per-key rate caps.
An app key can ONLY invoke its listed flows (and follow the runs it starts) — it cannot read or write anything else on the platform. The origin allowlist is an anti-abuse measure, not a security boundary: real authorization belongs inside your flows (e.g. jwt-tools verification against your app's own users).
Usage
axiom app-key [flags]
axiom app-key [command]Flags
| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
--help | -h | bool | help for app-key |
Subcommands
| Command | Description |
|---|---|
| axiom app-key create | Mint an app key restricted to the given flows |
| axiom app-key ls | List the tenant's API keys (app keys and PATs) |
| axiom app-key revoke | Revoke a key by id (see "axiom app-key ls") |
| axiom app-key update | Re-point an app key at new flows and/or browser origins (the key value is unchanged) |
See also
- axiom — Axiom CLI — build and push node packages
- axiom app-key create — Mint an app key restricted to the given flows
- axiom app-key ls — List the tenant's API keys (app keys and PATs)
- axiom app-key revoke — Revoke a key by id (see "axiom app-key ls")
- axiom app-key update — Re-point an app key at new flows and/or browser origins (the key value is unchanged)