---
title: "Mint an anonymous sandbox token with no human in the loop"
method: POST
path: "/api/agent/sandbox/mint"
tags: ["auth"]
---

# Mint an anonymous sandbox token with no human in the loop

`POST /api/agent/sandbox/mint`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/agent/sandbox/mint`
- Auth: none required

Anonymous (per-IP rate limited, 10/hr). The ONLY mint path that needs no human approval: every other token comes from the device-code flow, which ends at a Clerk sign-in. Returns a sandbox token scoped to `events:read_upcoming` and nothing else, valid 24h, tied to no member and not renewable. That scope reads upcoming/live events — the same data /api/events/upcoming and /api/events/get already serve with no token at all, so the token is for exercising the auth shape, not for reaching anything new. GET the same path for a self-describe contract without spending from the rate budget. For member-scoped access use POST /api/agent/signup/start.

## Response `201`

Sandbox token minted. The plaintext token is surfaced ONCE.

- SandboxMintResponse: An ephemeral, member-less sandbox credential. Not renewable and not upgradeable — mint a real token via the device-code flow for member-scoped access.
  - `ok` boolean, required
  - `token` string, required: Plaintext bearer token, surfaced ONCE. Send as `Authorization: Bearer <token>`.
  - `token_type` string, required: Always "Bearer".
  - `sandbox` boolean, required: Always true. WRITE verbs simulate instead of mutating.
  - `scopes` string[], required: Always exactly ["events:read_upcoming"].
  - `expires_in` integer, required: Seconds until the token stops working (86400).
  - `usage` string
  - `surfaces` object: MCP / A2A / REST base URLs to try the token against.
  - `note` string

## Other responses

- `400`: Body present but not valid JSON.
- `429`: Per-IP rate limit exceeded.
- `503`: Rate limiter or KV unavailable — minting is paused (fails CLOSED).

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)