---
title: "Tunnel Claim Pre Token"
method: POST
path: "/tunnel/claim"
---

# Tunnel Claim Pre Token

`POST /tunnel/claim`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/tunnel/claim`
- Auth: none declared

The app claims a pre-token from the onboarding and gets a NEW tunnel token.

lmcp-api#358: this answered the existing live token of (address, machine id). Neither is
proven here: the address is typed, the pre-token's machine id is set by /install/ping and its
address by the set-up page, all without authentication, so anyone holding an old pre-token
could read out another person's token. Now every claim mints, as /tunnel/token does (#229):
`email` NULL, the address in `contact_email`, under the mint limits (_mint_guarded). No
answer carries a token that existed before the call, and a repeat mints again.

No row is read by address: the 403 «Token revocado» for an address whose rows were all
revoked is gone (review of #358). It protected nothing once every claim mints a token of its
own, anyone could lift or cause it for an (address, machine id) pair, and it told a caller
whether an address had revoked rows. A revoked token stays revoked; the claim never revives
one. The claim is a retired path (no pre-token has been minted since 2026-06-12).

## Request body

- TunnelClaimRequest
  - `pre_token` string, required
  - `email` string, required
  - `license_key` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)