---
title: "axiom app-key create"
description: "Mint an app key restricted to the given flows"
category: reference
surfaces: [cli]
related: [reference/cli/axiom-app-key]
last_reviewed: 2026-06-06
---

<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
     Source of truth: the cobra command definitions in cmd/axiom/cmd/.
     Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->

# axiom app-key create

Mint an app key restricted to the given flows

Mint an invoke-scoped app key. The raw key is printed ONCE.

The key is PUBLIC by design — it is safe to embed in your app's JS bundle
because it can only invoke the flows you list here, at the rate caps you set,
and anything sensitive must be authorized inside the flows themselves.

```text
axiom app-key create --name my-app \
    --graph 01JGRAPHID... --graph 01JOTHERID... \
    --origin https://myapp.example.com \
    --rps 5 --burst 10
```

--origin limits which browser origins get CORS access (anti-abuse; servers and
curl are unaffected). --expires-days defaults to never expiring, the usual
choice for a shipped app.

## Usage

```sh
axiom app-key create [flags]
```

## Flags

| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
| `--burst` |  | int | `0` | Per-key burst size (default 10) |
| `--expires-days` |  | int | `0` | Key lifetime in days (default: never expires) |
| `--graph` |  | stringArray | `[]` | Graph ID the key may invoke (repeatable, required) |
| `--help` | `-h` | bool |  | help for create |
| `--json` |  | bool |  | Emit the mint response as JSON |
| `--name` |  | string |  | Display name for the key (required) |
| `--origin` |  | stringArray | `[]` | Browser origin to allowlist, e.g. https://myapp.example.com (repeatable) |
| `--rps` |  | int | `0` | Per-key rate cap in requests/second (default 5) |

## See also

- [axiom app-key](./axiom-app-key.md) — Manage invoke-scoped app keys (public browser credentials)