---
title: "Mint a scoped browser token"
method: POST
path: "/api/v1/client-tokens"
tags: ["canonical"]
---

# Mint a scoped browser token

`POST /api/v1/client-tokens`

## Request

- Base URL: `https://app.graypass.org` (the document declares no server; this is the origin it was published from)
- URL: `https://app.graypass.org/api/v1/client-tokens`
- Auth: HTTP bearer

Exchange backend authority for a short-lived browser token bound to one subject and exact registered origin.

## Request body

- ClientTokenCreate: Mint a short-lived, subject-bound browser credential for a registered origin.
  - `origin` string, required: Exact browser origin including scheme, hostname and non-default port. It must be registered for the tenant.
  - `subject` string, required: Pseudonymous subject identifier in the authenticated tenant and environment.
  - `ttl_seconds` integer: Browser-token lifetime in seconds; default 900, permitted range 60-3600.

## Response `201`

New browser token, exact origin, lifetime and Unix-seconds expiry.

- ClientTokenCreated: Browser credential issuance result. Treat client_token as a secret capability.
  - `client_token` string, required: Short-lived bearer token for the selected subject and origin. Keep it out of URLs, logs and persistent browser storage.
  - `expires_at` number, required: Token expiry as Unix time in seconds, which differs from the ISO timestamps used by most resource records.
  - `origin` string, required: Exact browser origin including scheme, hostname and non-default port. It must be registered for the tenant.
  - `ttl_seconds` integer, required: Browser-token lifetime in seconds; default 900, permitted range 60-3600.

## Other responses

- `422`: The canonical handler returns a Problem for invalid input; correct the request before retrying.

---

[API](https://skmtc.dev/graypass/apis/graypass-api.md) - [All operations](https://skmtc.dev/graypass/apis/graypass-api/llms.txt) - [OpenAPI document](https://skmtc.dev/graypass/apis/graypass-api/revisions/5f9ab64fdfdb?raw)