---
title: "Vend a short-TTL token confined to this one workspace (create-or-get; shown once) [org admin or manager token]"
method: POST
path: "/preview/org/workspaces/{slug}/tokens"
tags: ["org"]
---

# Vend a short-TTL token confined to this one workspace (create-or-get; shown once) \[org admin or manager token\]

`POST /preview/org/workspaces/{slug}/tokens`

## Request

- Base URL: `https://autoresearch.sfcompute.com`
- URL: `https://autoresearch.sfcompute.com/preview/org/workspaces/{slug}/tokens`
- Auth: HTTP bearer

Vend a short-lived token scoped to exactly one workspace (docs/designs/workspace-tenancy.md: the per-tenant credential). Creates the workspace if the slug is new (create-or-get; cap_usd applies only then - state a budget when each workspace is a tenant or an experiment). The vended token is a gmnt_ bearer for both doors carrying `infra` scope in that one workspace, expiring after ttl_hours (default 4, max 168); it can never manage workspaces, vend, see the rest of the org, or list/reference org secrets, so vending only NARROWS reach - the token is strictly weaker than the credential you hold - hand it to the session that should be confined there (e.g. one end user's agent). Shown once, not listed on /team; expired rows are swept. Org admins, or a manager service token.

## Path parameters

- `slug` string, required: The workspace slug the token is confined to (created if new - create-or-get).

## Query parameters

- `workspace` string

## Request body

- object
  - `cap_usd` number, double, nullable: Monthly spend cap in USD, applied only when this call CREATES the workspace. State a budget when each workspace is a tenant.
  - `org` string, nullable: Organization (uuid or name); omitted = your active org.
  - `ttl_hours` integer, nullable: Hours until the vended token expires: 1-168 (default 4).

## Response `200`

The capability's JSON result.

- Result: The capability's result: the same object the MCP tool returns as structuredContent. Resources carry an `object` type discriminator and an immutable id; money is integer micro-dollars in `*_usd_micros` fields.
  - `object` string: The resource type, when the result is one resource.

## Other responses

- `400`: Malformed request: bad JSON, a parameter that does not parse, or a value outside its range. Code `invalid`.
- `401`: No bearer token, or one this API cannot verify. Code `unauthenticated`.
- `403`: Authenticated, but the token's scopes or the account's role do not reach this operation. The message names the scope word to request. Code `forbidden`.
- `404`: No such route. Code `not_found`; the body names the OpenAPI document.
- `422`: A well-formed request the platform declined: no such node, a cap reached, a state that forbids the move. The message says which, and what to do instead. Code `refused`.
- `429`: Over this door's per-customer budget. Wait `Retry-After` seconds. Code `rate_limited`.
- `500`: Our fault. Retry; if it persists, quote the request-id. Code `internal`.

---

[API](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api.md) · [All operations](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/revisions/f88dcb70ac6c?raw)