---
title: "Exchange App Session"
method: POST
path: "/app-sessions/exchange"
tags: ["App Platform - Tokens"]
---

# Exchange App Session

`POST /app-sessions/exchange`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/app-sessions/exchange`
- Auth: HTTP bearer

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Mint a short-lived browser app token for the authenticated PropelAuth principal.

Auth is the EXISTING ``get_current_user`` PropelAuth dependency — no valid
principal -> 401. ``subject`` / ``client_org_id`` / ``role`` are derived
SERVER-SIDE from that validated principal (``derive_browser_identity``), never
from ``body`` — a forged identity/role in the body has no effect. Minting also
requires a consented installation of the target app in the principal's org (403).
A fail-closed per-principal / per-app limiter throttles the mint (429).

## Headers

- `X-Org-Id` string, nullable: The organization ID to use for the request

## Request body

- BrowserExchangeRequest: Body for the browser exchange — target app + non-identity params ONLY. Identity is DERIVED SERVER-SIDE from the authenticated PropelAuth principal (locked decision §5: "browser auth = PropelAuth login -> short-lived graph8 app token"): ``subject`` / ``client_org_id`` / ``role`` come from the validated principal, never from this body, so a client cannot self-assert who it is or escalate its role. Any ``subject`` / ``client_org_id`` / ``role`` keys a caller forges into the body are ignored (pydantic drops unknown fields).
  - `app_id` string, required: Target app id (dapp_-prefixed)
  - `scopes` string[]: Scopes to embed in the token

## Response `200`

Successful Response

- ApiResponseTokenResponse
  - `data` TokenResponse, required: The minted token + the non-secret metadata a client needs.
    - `access_token` string, required: The signed app JWT
    - `token_type` string: Always 'Bearer'
    - `expires_in` integer, required: Lifetime in seconds
    - `audience` string, required: The distinct-per-app, per-environment audience
    - `app_id` string, required: App the token is bound to
    - `kid` string, required: Signing key id (matches a JWKS entry)
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)