# Create the account key blob Sets the store's one account-scoped opaque blob, for example the wrapped key a person's devices share. It is **create-if-absent**: the first create wins (`201 Created`), and every later create, from any device and however concurrent, answers the stored value unchanged (`200 OK`). It is never replaced. So two devices setting up at the same moment both end with the one value that won. Always continue with the `blob` in the answer, not the one you sent. At most 2 KiB decoded. Requires an `Idempotency-Key` header: re-sending the same key answers the first call's exact response (header `Idempotent-Replayed: true`). #### Path Parameters **`store`** string required The store: `aitronos-browser`. Up to 64 characters; an unknown store is `404 SEALED_STORE_NOT_FOUND`. #### Headers **`Authorization`** string required `Bearer ` from the person's own sign-in. API keys and service accounts are refused with `403 SEALED_STORE_PERSONAL_SESSION_REQUIRED`. **`Idempotency-Key`** string required A random id minted once for this change and sent again on every retry of it: 16 to 128 printable ASCII characters, no spaces (a UUID works). The first accepted answer is remembered for 30 days; see [Idempotency-Key](/docs/api-reference/sealed-stores/introduction#idempotency-key). #### Body Parameters **`schema_version`** integer required The client's schema and sealing version for this value, 1 to 2,147,483,647. Stored and returned as sent; the server never interprets it. **`device_id`** string required The writing device's id: the device id this device signed in with. 16 to 255 characters of `A-Z a-z 0-9 . _ : @ -`. **`blob`** string required The opaque sealed blob, standard padded base64. At least 28 bytes and at most 2 KiB (2,048 bytes) decoded. ## Returns `201 Created` when this create set the blob, or `200 OK` with the blob that was already set, unchanged: - **`object`** string — `sealed_account_key`. - **`store`** string — the store's name. - **`schema_version`** integer — as the winning create sent it. - **`device_id`** string — the device whose create won. - **`created_at`** string — when it was created (ISO 8601 UTC). - **`blob`** string — the opaque blob, standard padded base64. - **`blob_bytes`** integer — its decoded size. Every answer carries the header **`Idempotent-Replayed`**: `false` on the first answer, `true` when this is the remembered answer to an `Idempotency-Key` sent before. ## Errors | Status | Code | When | | --- | --- | --- | | 401 | `AUTHENTICATION_REQUIRED` | No access token, or one that is not valid. | | 403 | `SEALED_STORE_PERSONAL_SESSION_REQUIRED` | The call used an API key or a service account. Only a person's own sign-in session reaches a sealed store. | | 404 | `SEALED_STORE_NOT_FOUND` | No store with that name (`details.store`). | | 409 | `SEALED_OPERATION_IN_PROGRESS` | An earlier call with this `Idempotency-Key` has not finished. Retry in a moment. | | 413 | `SEALED_PAYLOAD_TOO_LARGE` | `blob` is over 2 KiB decoded (`details.field`, `details.max_bytes`, `details.payload_bytes`). | | 422 | `SEALED_IDEMPOTENCY_KEY_REQUIRED` | No `Idempotency-Key` header. | | 422 | `SEALED_IDEMPOTENCY_KEY_INVALID` | The `Idempotency-Key` is not 16 to 128 printable ASCII characters without spaces. | | 422 | `SEALED_IDEMPOTENCY_KEY_REUSED` | The `Idempotency-Key` was already used for a different call. Mint a new one for a new change. | | 422 | `SEALED_PAYLOAD_INVALID` | `blob` is not standard padded base64, or decodes to fewer than 28 bytes (`details.field`). | | 422 | `VALIDATION_ERROR` | A body field is missing, of the wrong type or out of range. | ```bash cURL curl -X POST "https://api.aitronos.com/v1/sealed-stores/aitronos-browser/account-key" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Idempotency-Key: a4faefd3-8179-4ddc-b370-3ec2f84116cb" \ -H "Content-Type: application/json" \ -d '{ "schema_version": 1, "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "blob": "UjJN+KrSFlr8YoFmbFpc/hWHZXQdX3UeIEok/wCirsIhs2M6icaZukX/SKS2NUk8+fSjaQCjpqpBVke9hNGGwVulxI6Dg6XNvwr0hmQJClGN0Ihq7ELoXzcko+c=" }' ``` ```python Python import os import uuid import requests idempotency_key = str(uuid.uuid4()) # once per change; reuse it on every retry response = requests.post( "https://api.aitronos.com/v1/sealed-stores/aitronos-browser/account-key", headers={ "Authorization": f"Bearer {os.environ['AITRONOS_TOKEN']}", "Idempotency-Key": idempotency_key, }, json={ "schema_version": 1, "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "blob": "UjJN+KrSFlr8YoFmbFpc/hWHZXQdX3UeIEok/wCirsIhs2M6icaZukX/SKS2NUk8+fSjaQCjpqpBVke9hNGGwVulxI6Dg6XNvwr0hmQJClGN0Ihq7ELoXzcko+c=" }, timeout=30, ) body = response.json() if response.status_code in (200, 201): # Use the blob in the answer, not the one sent: on 200 another device won. account_blob = body["blob"] print("set by", body["device_id"], "at", body["created_at"]) else: print(response.status_code, body["error"]["code"]) ``` ```javascript JavaScript const idempotencyKey = crypto.randomUUID(); // once per change; reuse it on every retry const response = await fetch("https://api.aitronos.com/v1/sealed-stores/aitronos-browser/account-key", { method: "POST", headers: { Authorization: `Bearer ${process.env.AITRONOS_TOKEN}`, "Content-Type": "application/json", "Idempotency-Key": idempotencyKey, }, body: JSON.stringify({ "schema_version": 1, "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "blob": "UjJN+KrSFlr8YoFmbFpc/hWHZXQdX3UeIEok/wCirsIhs2M6icaZukX/SKS2NUk8+fSjaQCjpqpBVke9hNGGwVulxI6Dg6XNvwr0hmQJClGN0Ihq7ELoXzcko+c=" }), }); const body = await response.json(); if (response.ok) { // Use the blob in the answer, not the one sent: on 200 another device won. const accountBlob = body.blob; console.log("set by", body.device_id, "at", body.created_at, accountBlob.length); } else { console.log(response.status, body.error.code); } ``` **Response:** 201 Created ```json { "object": "sealed_account_key", "store": "aitronos-browser", "schema_version": 1, "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "created_at": "2026-10-01T12:03:58.019244Z", "blob": "UjJN+KrSFlr8YoFmbFpc/hWHZXQdX3UeIEok/wCirsIhs2M6icaZukX/SKS2NUk8+fSjaQCjpqpBVke9hNGGwVulxI6Dg6XNvwr0hmQJClGN0Ihq7ELoXzcko+c=", "blob_bytes": 92 } ``` 200 Already set ```json { "object": "sealed_account_key", "store": "aitronos-browser", "schema_version": 1, "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "created_at": "2026-10-01T12:03:58.019244Z", "blob": "UjJN+KrSFlr8YoFmbFpc/hWHZXQdX3UeIEok/wCirsIhs2M6icaZukX/SKS2NUk8+fSjaQCjpqpBVke9hNGGwVulxI6Dg6XNvwr0hmQJClGN0Ihq7ELoXzcko+c=", "blob_bytes": 92 } ``` 413 Blob too large ```json { "success": false, "error": { "code": "SEALED_PAYLOAD_TOO_LARGE", "message": "This item is too large to sync.", "system_message": "blob is 2112 bytes decoded; the ceiling is 2048", "type": "client_error", "status": 413, "details": { "field": "blob", "max_bytes": 2048, "payload_bytes": 2112 }, "trace_id": "21fd72a4-32eb-4671-ade1-54517aff9a79", "timestamp": "2026-10-01T12:03:41.552870Z" } } ``` ## Related Resources - [Sealed stores](/docs/api-reference/sealed-stores/introduction) - [Get the account key blob](/docs/api-reference/sealed-stores/get-account-key) - [Get a sealed store's limits](/docs/api-reference/sealed-stores/get-store) - [List sealed store changes](/docs/api-reference/sealed-stores/list-changes)