---
title: "Mint a connector and its bootstrap token"
method: POST
path: "/v1/runs/{runId}/connectors"
tags: ["Connectors"]
---

# Mint a connector and its bootstrap token

`POST /v1/runs/{runId}/connectors`

## Request

- Base URL: `https://api.ironfang.com/rig`
- URL: `https://api.ironfang.com/rig/v1/runs/{runId}/connectors`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Mints a connector on an active run and returns its bootstrap token once. The token is single-use, expires after ten minutes, and is bound to this organisation, this run and the route labels named (every label the run declares when none are given). Start `ironfang-connect` with it and a local target for each label; the connector exchanges it at the gateway for a session credential that lives no longer than the run. The platform only ever names a route label; what a label points at is decided on the connector's command line and never leaves the machine. Needs rig.connector. A run may have at most 16 connectors.

## Request body

- object
  - `name` string: A label for this connector in the timeline, such as the machine it runs on.
  - `routes` string[]: Route labels to bind the credential to; a subset of what the run declares. Default all of them.

## Response `201`

Connector minted; the bootstrap token appears here and nowhere else

- object
  - `bootstrap_expires_at` string, date-time, required
  - `bootstrap_token` string, required: The single-use credential, prefixed `ift_boot_`. Pass it to ironfang-connect in `IRONFANG_CONNECT_TOKEN`.
  - `command` string, required: The command line to complete with local targets.
  - `connector` Connector, required: One connector to a run. Its credentials never appear here: the bootstrap token is returned once at creation, the session credential once at the gateway.
    - `bootstrap_expires_at` string, date-time, required
    - `bootstrap_used_at` string, date-time
    - `client` object: What the connector said about itself at hello (version, os, arch).
    - `connected_at` string, date-time
    - `created_at` string, date-time, required
    - `created_by` string
    - `disconnected_at` string, date-time
    - `id` string, uuid, required
    - `last_seen_at` string, date-time
    - `name` string
    - `organisation_id` string, uuid, required
    - `routes` string[], required: The route labels the credential is bound to.
    - `run_id` string, uuid, required
    - `session_expires_at` string, date-time: Never later than the run's expiry.
    - `status` 'pending' | 'online' | 'offline', required
  - `gateway_url` string, uri, required: The WebSocket endpoint the connector dials.
  - `release` object: The ironfang-connect build to run, when the API knows it.
    - `checksums_url` string, uri, required: SHA-256 sums of every binary of that version.
    - `version` string, required
  - `routes` string[], required

## Other responses

- `400`: The body is not one strict JSON value of the documented shape (`invalid_json`).
- `401`: No credential, an invalid one, or a delegated token where none is accepted (`unauthorized`, `invalid_api_key`, `delegated_not_allowed`).
- `403`: The credential lacks the permission or scope, or names another organisation (`forbidden`, `insufficient_scope`).
- `404`: No such object in this organisation (`not_found`).
- `409`: The run has already ended (`run_not_active`).
- `422`: A field is invalid; the message names it (`invalid_request`).
- `429`: The run has its limit of connectors

---

[API](https://skmtc.dev/ironfang/apis/ironfang-rig-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-rig-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-rig-api/revisions/3e86a312dad1?raw)