App Platform - Tokens

Exchange App Session

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Mint a short-lived browser app token for the authenticated PropelAuth principal.

Auth is the EXISTING get_current_user PropelAuth dependency — no valid principal -> 401. subject / client_org_id / role are derived SERVER-SIDE from that validated principal (derive_browser_identity), never from body — a forged identity/role in the body has no effect. Minting also requires a consented installation of the target app in the principal's org (403). A fail-closed per-principal / per-app limiter throttles the mint (429).

post/app-sessions/exchange

Request

  • Base URL: https://be.graph8.com/api/v1
  • URL: https://be.graph8.com/api/v1/app-sessions/exchange
  • Auth: HTTP bearer

Headers

X-Org-Idstring nullable

The organization ID to use for the request

Request body

app_idstring required

Target app id (dapp_-prefixed)

scopesstring[]

Scopes to embed in the token

Response

Successful Response

Changes

No recorded changes to this operation across all 2 revisions of this API.