---
title: "Connect a browser extension"
method: POST
path: "/extension/connect"
tags: ["extension"]
---

# Connect a browser extension

`POST /extension/connect`

## Request

- Base URL: `https://task.igordudnek.com/api/v1`
- URL: `https://task.igordudnek.com/api/v1/extension/connect`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `lt_access`

Mints a scoped extension token limited to an allowlist: list projects, board manifest, create a task (+ tag / screenshot it), and time tracking — GET /me/whoami, /me/tasks (lite), /me/workday (lite), /me/timer, POST /me/timer/stop, POST /tasks/{tid}/timer/start. Nothing destructive/admin; any other route answers 403 (the token stays valid). Must be called from a signed-in web session (lt_access cookie / JWT); an API/extension token gets 403. The raw token is returned exactly once.

## Request body

- ConnectExtensionRequest
  - `device_label` string
  - `project_id` string, uuid

## Response `201`

OK

- ExtensionTokenIssued
  - `device_label` string
  - `id` string, uuid, required
  - `scope_project_id` string, uuid
  - `token` string, required

---

[API](https://skmtc.dev/loopertask/apis/loopertask-api.md) · [All operations](https://skmtc.dev/loopertask/apis/loopertask-api/llms.txt) · [OpenAPI document](https://skmtc.dev/loopertask/apis/loopertask-api/revisions/5d9903f15162?raw)