<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
Source of truth: the cobra command definitions in cmd/axiom/cmd/.
Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->
axiom app-key create
Mint an app key restricted to the given flows
Mint an invoke-scoped app key. The raw key is printed ONCE.
The key is PUBLIC by design — it is safe to embed in your app's JS bundle because it can only invoke the flows you list here, at the rate caps you set, and anything sensitive must be authorized inside the flows themselves.
axiom app-key create --name my-app \
--graph 01JGRAPHID... --graph 01JOTHERID... \
--origin https://myapp.example.com \
--rps 5 --burst 10--origin limits which browser origins get CORS access (anti-abuse; servers and curl are unaffected). --expires-days defaults to never expiring, the usual choice for a shipped app.
Usage
axiom app-key create [flags]Flags
| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
--burst | int | 0 | Per-key burst size (default 10) | |
--expires-days | int | 0 | Key lifetime in days (default: never expires) | |
--graph | stringArray | [] | Graph ID the key may invoke (repeatable, required) | |
--help | -h | bool | help for create | |
--json | bool | Emit the mint response as JSON | ||
--name | string | Display name for the key (required) | ||
--origin | stringArray | [] | Browser origin to allowlist, e.g. https://myapp.example.com (repeatable) | |
--rps | int | 0 | Per-key rate cap in requests/second (default 5) |
See also
- axiom app-key — Manage invoke-scoped app keys (public browser credentials)
Related