---
title: "Mint a form sync token"
method: POST
path: "/api/v1/manage/sync-tokens"
tags: ["Credentials"]
---

# Mint a form sync token

`POST /api/v1/manage/sync-tokens`

## Request

- Base URL: `https://fillo.so`
- URL: `https://fillo.so/api/v1/manage/sync-tokens`
- Auth: HTTP bearer

Mint a stage-only deployment credential. It can stage code-defined schema changes and nothing else: it can never publish, read responses, or manage the workspace. The plaintext is returned EXACTLY ONCE. The token is bound to the human who minted the key; if that account was removed or demoted, minting is refused with 403. Scope: workspace:manage.

## Request body

- object
  - `name` string: What it is for, e.g. deploy or ci. Defaults to "Form sync".

## Response `201`

The minted token, shown once.

- object
  - `token` string, required: The `fsync_` plaintext. Shown once — store it now.
  - `name` string, required

## Other responses

- `400`: Invalid request (e.g. a body on a GET/DELETE, or a missing required query parameter).
- `401`: Missing, malformed, unknown, revoked, or expired key.
- `403`: The key is valid but lacks the required scope.
- `404`: No such resource in this project (returned instead of 403 for ids in other projects).
- `409`: The request was understood but refused in this state — an unmet precondition, or a confirm value that did not match. Nothing was changed.
- `413`: The request body exceeded the 16 KiB management cap.
- `429`: Per-key (120/min), per-workspace (240/min), or per-IP (300/min) rate limit exceeded. Retry after the Retry-After header.

---

[API](https://skmtc.dev/fillo/apis/fillo-management-api.md) · [All operations](https://skmtc.dev/fillo/apis/fillo-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fillo/apis/fillo-management-api/revisions/867f943f04f5?raw)