---
title: "Mint an installation credential"
method: POST
path: "/connectors/v1/installations/{id}/tokens"
tags: ["Connectors"]
---

# Mint an installation credential

`POST /connectors/v1/installations/{id}/tokens`

## Request

- Base URL: `https://api.case.dev`
- URL: `https://api.case.dev/connectors/v1/installations/{id}/tokens`
- Auth: HTTP bearer

Bound application management API key only. Returns a 256-bit opaque bearer secret once; valid for 15 minutes, connector data-plane only. No refresh token. At most 4 overlapping credentials and 20 mints/minute per installation. The application server must derive tenant identity; this is not browser authentication.

## Path parameters

- `id` string, required

## Request body

- object
  - `scopes` string[], required

## Response `201`

Credential minted; never put it in a URL or log

- object
  - `id` string, required
  - `token` string, required
  - `expires_at` string, date-time, required
  - `installation_id` string, required

## Other responses

- `400`: Invalid scopes
- `401`: Invalid credential
- `403`: Active application management key required
- `404`: Installation not found
- `429`: Issuance limit reached

## Changes

- **2026-10-16** `a21d188f4b21`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/casemark/apis/case-dev-api/changes/connectors/v1/installations/:id/tokens/post.md)

---

[API](https://skmtc.dev/casemark/apis/case-dev-api.md) - [All operations](https://skmtc.dev/casemark/apis/case-dev-api/llms.txt) - [OpenAPI document](https://skmtc.dev/casemark/apis/case-dev-api/revisions/9a3245c00044?raw)