---
title: "Mint a per-user app session token for a login-required deep-agent artifact"
method: POST
path: "/v1/app-gateway/{appId}/session"
tags: ["app-gateway"]
---

# Mint a per-user app session token for a login-required deep-agent artifact

`POST /v1/app-gateway/{appId}/session`

Mints a per-user app token for the signed-in viewer opening a login-required deep-agent artifact. Authed as the b3 user; the viewer's id + active org come from the auth context, not the body. The server resolves the artifact's org from the :appId (deep-agent run id), verifies the workflow is in it and the viewer is acting within it, then signs a token carrying the viewer's id.

## Path parameters

- `appId` string, required

## Request body

- union
  - object
  - AppGatewayMintViewerTokenParams
    - `workflowId` string

## Response `200`

OK

- AppGatewayMintTokenResponse
  - `exp` string
  - `token` string

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.dev/b3os/apis/b3os-workflow-api.md) · [All operations](https://skmtc.dev/b3os/apis/b3os-workflow-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/b3os/b3os-workflow-api/revisions/a8c7af3c66a1/schema)