---
title: "POST /code/runtimes/{runtimeId}/token"
method: POST
path: "/code/runtimes/{runtimeId}/token"
---

# POST /code/runtimes/{runtimeId}/token

`POST /code/runtimes/{runtimeId}/token`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/code/runtimes/{runtimeId}/token`
- Auth: none required

POST /api/v1/code/runtimes/{runtimeId}/token on the Caveman Cloud control plane. Authenticated by the body: an Ed25519 signature, with the runtime's enrolled key, over "caveman-code-runtime-token/v1\n<organization_id>\n<runtime_id>\n<issued_at>" (issued_at in Unix seconds, within 60 s of now and later than the last one used). Rate-limited per address. Not exposed to autonomous agents: Not RBAC-guarded — authenticated by a Caveman Code runtime token or by the enrolled key's signed assertion that mints one. Agents authenticate through a scoped control-plane session and never touch these directly.

## Response `2XX`

Successful response. Exact status depends on synchronous or durable delivery outcome.

## Other responses

- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)