App Platform - Tokens

Issue Service Token

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Mint a service (client-credentials) app token bound to the credential's org.

A fail-closed per-credential limiter throttles the mint (429) before the credential is even checked, so brute-forcing a client secret is rate-bound.

post/service-token

Request

  • Base URL: https://be.graph8.com/api/v1
  • URL: https://be.graph8.com/api/v1/service-token
  • Auth: HTTP bearer

Request body

client_idstring required

Service credential client id

client_secretstring required

Service credential client secret (checked against stored hash)

scopesstring[]

Scopes to embed in the token

ttl_secondsinteger nullable

Requested TTL; clamped into the 30-60m service band

Response

Successful Response

Changes

No recorded changes to this operation across all 2 revisions of this API.