---
title: "axiom app-key"
description: "Manage invoke-scoped app keys (public browser credentials)"
category: reference
surfaces: [cli]
related: [reference/cli/axiom, reference/cli/axiom-app-key-create, reference/cli/axiom-app-key-ls, reference/cli/axiom-app-key-revoke, reference/cli/axiom-app-key-update]
last_reviewed: 2026-06-06
---

<!-- GENERATED by docs/scripts/gen-cli-reference — DO NOT EDIT.
     Source of truth: the cobra command definitions in cmd/axiom/cmd/.
     Regenerate from the repo root with: go run ./docs/scripts/gen-cli-reference -->

# axiom app-key

Manage invoke-scoped app keys (public browser credentials)

Manage invoke-scoped app keys: PUBLIC, long-lived credentials a browser app
ships in its bundle, restricted to a fixed set of flows (graph IDs) with an
origin allowlist and per-key rate caps.

An app key can ONLY invoke its listed flows (and follow the runs it starts) —
it cannot read or write anything else on the platform. The origin allowlist is
an anti-abuse measure, not a security boundary: real authorization belongs
inside your flows (e.g. jwt-tools verification against your app's own users).

## Usage

```sh
axiom app-key [flags]
axiom app-key [command]
```

## Flags

| Flag | Shorthand | Type | Default | Description |
|---|---|---|---|---|
| `--help` | `-h` | bool |  | help for app-key |

## Subcommands

| Command | Description |
|---|---|
| [axiom app-key create](./axiom-app-key-create.md) | Mint an app key restricted to the given flows |
| [axiom app-key ls](./axiom-app-key-ls.md) | List the tenant's API keys (app keys and PATs) |
| [axiom app-key revoke](./axiom-app-key-revoke.md) | Revoke a key by id (see "axiom app-key ls") |
| [axiom app-key update](./axiom-app-key-update.md) | Re-point an app key at new flows and/or browser origins (the key value is unchanged) |

## See also

- [axiom](./axiom.md) — Axiom CLI — build and push node packages
- [axiom app-key create](./axiom-app-key-create.md) — Mint an app key restricted to the given flows
- [axiom app-key ls](./axiom-app-key-ls.md) — List the tenant's API keys (app keys and PATs)
- [axiom app-key revoke](./axiom-app-key-revoke.md) — Revoke a key by id (see "axiom app-key ls")
- [axiom app-key update](./axiom-app-key-update.md) — Re-point an app key at new flows and/or browser origins (the key value is unchanged)