> ## Documentation Index > Fetch the complete documentation index at: https://docs.agentsfleet.net/llms.txt > Use this file to discover all available pages before exploring further. # Mint a command-line credential > Creates a durable credential for one machine, with the `afc_` prefix. The raw credential is returned once. Only its SHA-256 hash is saved, so it cannot be read back later. A credential belongs to a person, not to a team. Call this with a browser session token or with an existing command-line credential. A tenant API key is refused. Minting revokes whatever credential the same machine name already held. One machine holds one live credential at a time. ## OpenAPI ````yaml https://raw.githubusercontent.com/agentsfleet/agentsfleet/main/public/openapi.json post /v1/cli-credentials openapi: 3.1.0 info: title: agentsfleet Control Plane API description: API for managing workspaces, fleets, triggers, and runs. contact: name: agentsfleet url: https://agentsfleet.net license: name: MIT identifier: MIT version: 1.0.0 servers: - url: https://api.agentsfleet.net description: Production security: [] paths: /v1/cli-credentials: post: tags: - CLI Credentials summary: Mint a command-line credential description: >- Creates a durable credential for one machine, with the `afc_` prefix. The raw credential is returned once. Only its SHA-256 hash is saved, so it cannot be read back later. A credential belongs to a person, not to a team. Call this with a browser session token or with an existing command-line credential. A tenant API key is refused. Minting revokes whatever credential the same machine name already held. One machine holds one live credential at a time. operationId: create_cli_credential requestBody: content: application/json: schema: $ref: '#/components/schemas/MintCliCredentialRequest' required: true responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/MintedCliCredentialResponse' '400': description: The request could not be read content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '401': description: No credential, or one this route does not accept content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '403': description: The caller is not a person this tenant knows content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '413': description: The payload is over this route's ceiling content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '429': description: The instance is at its ceiling content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '500': description: The daemon failed to answer content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' '503': description: A dependency this route needs is unreachable content: application/problem+json: schema: $ref: '#/components/schemas/ProblemBody' security: - BearerAuth: [] components: schemas: MintCliCredentialRequest: type: object description: '`POST /v1/cli-credentials` — mint this machine''s credential.' required: - machine_name properties: machine_name: type: string description: The terminal's own label, as an operator will read it back. MintedCliCredentialResponse: type: object description: |- The only response that returns a command-line credential in plaintext. Save the value when you receive it. No later call returns it again. required: - id - credential - machine_name - deployment properties: credential: type: string description: The credential itself. Shown once and never stored in this shape. deployment: type: string description: The deployment that minted it — this daemon, never a caller's claim. id: type: string description: The credential row's identifier, which the revoke addresses it by. machine_name: type: string description: The terminal's label, echoed back as it was stored. ProblemBody: type: object description: The body every refusal carries, under `application/problem+json`. required: - docs_uri - title - detail - error_code - request_id properties: action_id: type: - string - 'null' description: 'On that 409 only: the action the gate held.' current_state: type: - string - 'null' description: 'On a 409 only: the state that forbade the transition.' detail: type: string description: One sentence on what was refused and why. docs_uri: type: string description: Where the error code is documented. error_code: type: string description: The registry code, stable across releases. etag: type: - string - 'null' description: >- On a 412 only: the resource's current entity tag, to refetch and retry. gate_id: type: - string - 'null' description: 'On an answered approval gate''s 409 only: the gate that was answered.' missing_secrets: type: - array - 'null' items: type: string description: 'On a 424 only: the credentials this workspace has yet to store.' outcome: type: - string - 'null' description: 'On that 409 only: the answer that stands.' request_id: type: string description: The request this refusal answers, for support. resolved_at: type: - integer - 'null' format: int64 description: 'On that 409 only: when the standing answer was given.' resolved_by: type: - string - 'null' description: 'On that 409 only: who gave it.' title: type: string description: A short name for the refusal, safe to show a person. user_message: type: - string - 'null' description: A curated sentence for end users, where the code has one. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Obtain a token via the CLI auth flow (POST /v1/auth/sessions) or GitHub OAuth ````