---
title: "Mint an endpoint token"
method: POST
path: "/sandboxes/{sandbox_id}/endpoint-token"
tags: ["Sandboxes"]
---

# Mint an endpoint token

`POST /sandboxes/{sandbox_id}/endpoint-token`

## Request

- Base URL: `https://api.hedra.com/v3`
- URL: `https://api.hedra.com/v3/sandboxes/{sandbox_id}/endpoint-token`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

A token for the `url` of an `active` sandbox created with `ports`, sent
as `Authorization: Bearer`, and `browser_url`, the link that opens `url`
in a browser. Both work for every replica until the end of the sandbox's
`ttl_seconds` or 30 days after the mint, whichever is earlier; rotating
the signing key revokes them.

## Path parameters

- `sandbox_id` string, required: The sandbox's id (`sandbox_<uuid>`).

## Response `200`

Successful Response

- SandboxEndpointToken: A token for a sandbox's `url`, sent as `Authorization: Bearer`, and the link that opens `url` in a browser.
  - `token` string, required: The endpoint token.
  - `url` string, required: The sandbox's `url`, the address to send `token` to.
  - `browser_url` string, required: The link to open in a browser: `url` with `token` as its `hedra_token` query parameter. The sandbox answers the first request with a cookie that holds `token` and a redirect to the same address without the parameter, so that browser stays signed in to this sandbox until `expires_at`, or until a signing-key rotation revokes `token`. It is a credential, as `token` is: anyone who opens it reaches the sandbox until then.
  - `expires_at` string, date-time, required: When `token` stops working: the end of the sandbox's `ttl_seconds` or 30 days after the mint, whichever is earlier, later only by the time the mint took. Mint a new one before then.

## Other responses

- `400`: Invalid or failed-validation request. `FAILED_PRECONDITION`: the sandbox is not `active`, has under a minute of `ttl_seconds` left, or has no `url`.
- `401`: Authentication failed: missing, malformed, or invalid credentials.
- `403`: Insufficient scope or plan.
- `404`: Resource not found.
- `429`: Rate limit exceeded.
- `500`: Internal error.
- `503`: Sandboxes are temporarily unavailable, or are still being set up for your workspace; retry shortly.

## Changes

- **2026-10-28** `c482e691c208`: 1 info
  - added the required property `browser_url` to the response with the `200` status
- **2026-10-23** `e733493214f4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hedra-labs/apis/hedra-api/changes/sandboxes/:sandbox_id/endpoint-token/post.md)

---

[API](https://skmtc.dev/hedra-labs/apis/hedra-api.md) - [All operations](https://skmtc.dev/hedra-labs/apis/hedra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hedra-labs/apis/hedra-api/revisions/6ef35a11cefe?raw)