> ## Documentation Index
> Fetch the complete documentation index at: https://open-fi.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a session key

> Issue a time-bound, velocity-bound allowance scoped to a mandate: the credential an autonomous agent actually holds.

A session key is what gets handed to an AI agent or automated process. It is checked on every [debit pull](/api-reference/agentic/create-debit-pull) against the on-chain [Allowance State Machine](/essentials/allowance-state-machine), so it can never authorize more than its parent mandate's ceiling for the current epoch.

### Body Parameters

<ParamField body="mandate_id" type="string" required>
  The mandate this session key is scoped to.
</ParamField>

<ParamField body="expires_in" type="integer" required>
  Time-to-live in seconds. Common values: `3600` (1 hour), `86400` (1 day).
</ParamField>

<ParamField body="max_amount_override" type="number">
  Optional tighter ceiling for this specific key, must be ≤ the parent mandate's `max_amount`.
</ParamField>

<ParamField body="restricted_destinations" type="array">
  Optional allow-list of destination addresses or account IDs this key may pay out to.
</ParamField>

### Response

<ResponseField name="id" type="string">
  Session key ID, prefixed `sk_`.
</ResponseField>

<ResponseField name="status" type="string">
  `active`, `expired`, or `revoked`.
</ResponseField>

<RequestExample>
  ```bash cURL theme={null}
  curl https://api.openfi.co/v1/session-keys \
    -H "Authorization: Bearer $OPENFI_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "mandate_id": "man_01HZY...",
      "expires_in": 86400
    }'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "id": "sk_01HZZ...",
    "mandate_id": "man_01HZY...",
    "status": "active",
    "expires_at": "2026-08-28T14:05:00Z"
  }
  ```
</ResponseExample>

## Revoking a session key

```bash theme={null}
curl -X DELETE https://api.openfi.co/v1/session-keys/sk_01HZZ... \
  -H "Authorization: Bearer $OPENFI_API_KEY"
```

Revoking a session key does not affect the parent mandate or any other session keys issued under it.