> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a one-time claim token for its API key

> Burn a one-time claim token and return the raw API key it carried — the public
exchange leg of QR onboarding (``authed=False``; runtime public-ness comes from the
always-public ``/api/login`` prefix).

The claim record is single-use: a used / unknown / expired token all answer the SAME
404 (no oracle distinguishing them). The handed-out key is guaranteed not-REVOKED
(re-validated at exchange), NOT owner-alive — owner-death is enforced by the gate on
every request. Response mirrors the ``loginResult`` wire shape:
``{"data": {"token": <raw key>, "user_id": ...}}``.

``authority_changing=True`` keeps this OFF the default MCP tool surface: a
credential-exchange login door is not an agent tool (it sits outside the
``/api/auth/*`` prefix, so the flag is what excludes it, not the prefix).



## OpenAPI

````yaml /openapi.json post /api/login/claim
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 0.1.1
servers: []
security: []
paths:
  /api/login/claim:
    post:
      tags:
        - login
      summary: Exchange a one-time claim token for its API key
      description: >-
        Burn a one-time claim token and return the raw API key it carried — the
        public

        exchange leg of QR onboarding (``authed=False``; runtime public-ness
        comes from the

        always-public ``/api/login`` prefix).


        The claim record is single-use: a used / unknown / expired token all
        answer the SAME

        404 (no oracle distinguishing them). The handed-out key is guaranteed
        not-REVOKED

        (re-validated at exchange), NOT owner-alive — owner-death is enforced by
        the gate on

        every request. Response mirrors the ``loginResult`` wire shape:

        ``{"data": {"token": <raw key>, "user_id": ...}}``.


        ``authority_changing=True`` keeps this OFF the default MCP tool surface:
        a

        credential-exchange login door is not an agent tool (it sits outside the

        ``/api/auth/*`` prefix, so the flag is what excludes it, not the
        prefix).
      operationId: post_api_login_claim
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClaimExchange'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data: {}
                required:
                  - data
                type: object
          description: Success.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Resource not found.
components:
  schemas:
    ClaimExchange:
      description: Exchange a one-time claim token for its API key.
      properties:
        token:
          minLength: 1
          title: Token
          type: string
      required:
        - token
      title: ClaimExchange
      type: object
    Error:
      properties:
        error:
          type: string
      required:
        - error
      type: object

````