> ## Documentation Index > Fetch the complete documentation index at: https://docs.getcliq.io/llms.txt > Use this file to discover all available pages before exploring further. # Get a realm's dispatch public key > Returns a realm's dispatch public key, creating the key pair if the realm has none yet. Daemons check CliqHub's dispatch tokens with it. Requires a realm member (or higher) on the realm given by `realm_id`. ## OpenAPI ````yaml /openapi/hub-by-tag/hub-auth.yaml post /v1/auth/get_dispatch_public_key openapi: 3.0.3 info: title: 'CliqHub API: Auth' version: 1.0.0 description: >- API tokens. Every call to CliqHub carries one as `Authorization: Bearer `: - **User token** (`cliq_tok_…`): acts as you, optionally limited by `permissions` (which organizations and realms, and read / write / admin per kind of resource). `cliq login` stores one; mint more for scripts and CI. - **Realm token** (`cliq_dt_…`): what a daemon uses to join and work in a realm. Any member of the realm can mint one. - **A2A token** (`cliq_a2a_…`): what outside agents send to a realm's A2A endpoint. One per realm; minting a new one replaces the old. - **Dispatch token**: a short-lived signed token CliqHub uses when it sends work to a daemon; each realm has a dispatch key pair for it. A token is shown only when it is minted or rotated. A restricted token cannot mint a token wider than itself. servers: - url: https://{host} variables: host: default: cliqhub.io description: CliqHub host security: [] tags: - name: Auth description: >- API tokens. Every call to CliqHub carries one as `Authorization: Bearer `: - **User token** (`cliq_tok_…`): acts as you, optionally limited by `permissions` (which organizations and realms, and read / write / admin per kind of resource). `cliq login` stores one; mint more for scripts and CI. - **Realm token** (`cliq_dt_…`): what a daemon uses to join and work in a realm. Any member of the realm can mint one. - **A2A token** (`cliq_a2a_…`): what outside agents send to a realm's A2A endpoint. One per realm; minting a new one replaces the old. - **Dispatch token**: a short-lived signed token CliqHub uses when it sends work to a daemon; each realm has a dispatch key pair for it. A token is shown only when it is minted or rotated. A restricted token cannot mint a token wider than itself. paths: /v1/auth/get_dispatch_public_key: post: tags: - Auth summary: Get a realm's dispatch public key description: >- Returns a realm's dispatch public key, creating the key pair if the realm has none yet. Daemons check CliqHub's dispatch tokens with it. Requires a realm member (or higher) on the realm given by `realm_id`. operationId: POST_v1_auth_get_dispatch_public_key requestBody: required: true content: application/json: schema: type: object properties: realm_id: type: string minLength: 1 description: The realm. required: - realm_id examples: default: value: realm_id: 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b responses: '200': description: Success. content: application/json: schema: $ref: '#/components/schemas/DispatchPublicKey' properties: ok: type: boolean enum: - true description: Always `true` on success. required: - ok example: ok: true realm_id: 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b public_key_pem: | -----BEGIN PUBLIC KEY----- MIIBIjANBgkq… -----END PUBLIC KEY----- created_at: '2026-09-01T00:00:00Z' rotated_at: null '401': description: >- `unauthorized`: No `Authorization` header, or the token is malformed, expired or revoked. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: unauthorized: summary: unauthorized value: ok: false error: code: unauthorized message: Authentication required '403': description: >- `forbidden`: You can see the realm but your role there is too low or lacks the required permission. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: forbidden: summary: forbidden value: ok: false error: code: forbidden message: You do not have access to do this '404': description: >- `not_found`: The realm does not exist, was deleted, or you are not a member of it (404 rather than 403, so its existence is not revealed). content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: not_found: summary: not_found value: ok: false error: code: not_found message: Not found '422': description: >- `invalid_params`: The body fails the request schema: a field is missing or has the wrong type. `details.issues` lists each problem. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: invalid_params: summary: invalid_params value: ok: false error: Required code: invalid_params details: issues: - field: realm_id message: Required '500': description: >- `internal_error`: An unexpected server fault. Retry later; if it persists, report it with the time of the request. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: internal_error: summary: internal_error value: ok: false error: Internal server error code: internal_error security: - BearerAuth: [] components: schemas: DispatchPublicKey: type: object required: - realm_id - public_key_pem properties: realm_id: type: string public_key_pem: type: string description: The realm's dispatch public key (PEM). created_at: type: string rotated_at: type: string nullable: true HubErr: type: object required: - ok - error description: >- Every failure. Route-policy denials (401/403/404, and 400 when neither realm_id nor org_id was sent) answer `error` as `{ code, message }`; errors raised by the endpoint answer `error` as the message with the code beside it in `code`. Every error has a code. See [Errors](/hub-api/errors). properties: ok: type: boolean description: Always false on error error: description: The message, or `{ code, message }` for an access denial. oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string code: type: string description: Stable error code of an endpoint error. details: type: object additionalProperties: true description: Structured detail, when there is some. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: cliq_tok_* | cliq_dt_* description: >- User PAT (`cliq_tok_…`, including session-scoped) or realm token (`cliq_dt_…`). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.