---
title: "Create an embed sign-in token"
method: POST
path: "/api/apps/{app_id}/embed-url"
---

# Create an embed sign-in token

`POST /api/apps/{app_id}/embed-url`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/embed-url`
- Auth: one of:
  - HTTP bearer
  - API key in header `api_key`
  - HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Creates a single-use sign-in token for a provisioned app user and returns `embed_url`, the chosen surface's address with the token on it. Load it in an iframe and the app opens signed in as that user. The app's owner can be signed in without being provisioned, by a workspace API key or by the owner's own token. `live_preview` starts the app's sandbox if it isn't running; until it is, the URL shows a loading page. Call it with a personal access token whose owner can edit the app, or with a workspace API key that has the **Mint embed sign-in tokens** permission. Limited to 300 requests a minute per app. Higher plans get a higher limit.

## Path parameters

- `app_id` string, required: ID of the app.

## Request body

- EmbedTokenPayload: The app user to mint for, and which of the app's surfaces to frame.
  - `email` string, email, required: The app user's email
  - `target` 'live_site' | 'latest_preview' | 'live_preview': The surfaces a platform may frame, named by their ``UrlType``. A subset rather than ``UrlType`` itself: the rest of that enum is either internal (``platform``, ``pentest``) or addresses a revision, and a public payload should not offer what it will only refuse.

## Response `200`

Successful Response

- EmbedTokenResponse: A single-use sign-in token, and the URL that spends it.
  - `token` string, required: The single-use sign-in token. Already on `embed_url`; you don't need to send it anywhere yourself.
  - `expires_in` integer, required: Seconds until the token expires.
  - `embed_url` string, required: The chosen surface's address with the token on it. Load it in an iframe.

## Other responses

- `400`: The app has no address for `target`: error.code app_not_deployed or app_has_no_slug.
- `401`: Missing or invalid credentials.
- `403`: The email belongs to an editor or a service account, or to the app's owner when another user asks: error.code privileged_user.
- `404`: The email isn't provisioned for this app: error.code unknown_user.
- `422`: Validation Error
- `429`: The app went over its per-minute limit for embed sign-in tokens.

## Changes

- **2026-10-20** `bbcd7d7e2e72`: 1 info
  - the endpoint scheme security `WorkspaceApiKeyBearerAuth` was added to the API
- **2026-10-11** `80287813ab84`: 2 info
  - the security scope `app_users:embed_token` was added to the endpoint's security scheme `WorkspaceApiKeyAuth`
  - the security scope `full_access` was added to the endpoint's security scheme `PersonalAccessTokenAuth`
- **2026-10-07** `dddf17e0f9f0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/apps/:app_id/embed-url/post.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/c534f09cf314?raw)