#2033: mints a qp-bound connector identifier for a web AI whose connector UI has a single URL field — Grok, and every web AI on Windows until #2158 ships working OAuth there (see copyConnectorForAgent in go-server). The real tunnel_token authenticates THIS call via the JSON body — never a query string, or this endpoint would repeat the exact mistake it exists to fix (enforced by FastAPI's body-model binding, not by hand: token is a Pydantic field, so a ?token= on this URL is simply ignored).

The returned qp_token is NOT the tunnel_token — a distinct value, one per (machine, kind), resolved back to the real token by _resolve_qp_connector_token. It is EQUALLY capable if it leaks (authenticates tools/call exactly like the real token); the point is blast radius, not severity: re-minting a kind revokes only that kind's previous qp_token, leaving the real tunnel_token and every other kind's binding untouched — unlike /tunnel/rotate, which replaces the real token itself. #2326's point-of-use approval does NOT (yet) cover this path — see #2033 for why.