sandboxes

Generate a service access token

Changed on

Create a short-lived JWT for accessing an HTTP service running on a specific port inside a sandbox. Returns a browser_url (sets auth cookie via redirect), an embed_url (for an iframe; carries the token in the URL fragment, so no server or Referer sees it), a service_url (for use with the X-Langsmith-Sandbox-Service-Token header), the raw token, and its expiry. Set access=restricted|workspace to instead enable durable LangSmith login (no token; users authenticate with their normal LangSmith session), or access=off to disable it. embed_origins names the pages that may show the URL in an iframe. In token mode they are bound into the minted token; with LangSmith login they are stored on the grant and a viewer signs in from inside the frame through a LangSmith popup. LangSmith login and token access are mutually exclusive per service URL.

post/api/v2/sandboxes/boxes/{name}/service-url

Request

  • Base URL
    https://api.smith.langchain.com
  • URL
    https://api.smith.langchain.com/api/v2/sandboxes/boxes/{name}/service-url
  • Auth
    • API key in header X-API-Key
    • or API key in header X-Tenant-Id
    • or HTTP bearer

Path parameters

namestring required

Sandbox display name

Request body

access'restricted' | 'workspace' | 'off'

Access selects the login mode, mutually exclusive with the minted token. Omit the field for token mode: mint a short-lived service token (default). "restricted" — LangSmith login: the sandbox's creator, or any user with SandboxesExec on it (admins by default). "workspace" — LangSmith login: any member of the owning workspace. "off" — remove an existing LangSmith login grant and mint a token. A LangSmith login grant is durable; token mode is refused (409) while one exists.

embed_originsstring[]

EmbedOrigins are the pages allowed to show the service URL in an iframe, besides LangSmith itself: at most 5 origins such as https://app.example.com (http only for localhost). In token mode they are bound into the minted token, so they last as long as it does. With access "restricted" or "workspace" each call sets the grant's whole list, so omitting the field removes any origins set before.

expires_in_secondsinteger
portinteger

Response

OK

access'restricted' | 'workspace'

Access echoes the enabled LangSmith login level ("restricted"/"workspace"); omitted in token mode.

browser_urlstring
embed_originsstring[]

EmbedOrigins echoes the origins that may embed the URL, normalized; omitted when there are none.

embed_urlstring

EmbedURL opens the service in an iframe: the token rides the URL fragment, which no server, log or Referer header sees, and the page it loads trades it for the cookie. Append &redirect=/path to land elsewhere than /. Omitted in LangSmith login mode.

expires_atstring
service_urlstring
tokenstring

Token and ExpiresAt are empty in LangSmith login mode (no token is minted).

Changes

  • dfe647d1748eRevision changes
    • info

      added the optional property to the response with the status

  • 016683c2a6e3Revision changes
    • info

      added the new optional request property

    • info

      added the optional property to the response with the status