Updates the agent’s key binding to a new provider API key hash. The agent ID, traces, alignment card, integrity score, and trust edges are fully preserved.
Security model: Your API key is hashed on your device (SHA-256) before transmission — the raw key is never sent to Mnemom servers.
Named agents: If this agent was registered with a name (via x-smoltbot-agent), hash the new key as SHA256(newKey + '|' + agentName) before submitting.
Conflict: If the new key was already used and auto-created a new agent, the endpoint returns 409 with the conflicting agent ID.
Supabase JWT token in Authorization: Bearer header
Agent identifier (e.g. smolt-abc123)
First 16 hex characters of SHA256(newApiKey) for unnamed agents, or SHA256(newApiKey + '|' + agentName) for named agents. Compute client-side — do not transmit the raw key.
^[0-9a-f]{16}$"a3f8c1d9e7b2045f"
First 16 characters of the new provider API key. Stored for display — not sensitive. If provided, returned in the response.
"sk-ant-api03-xx"