AgentToken

Exchange an API key for an external agent token

Changed on

Exchanges a workspace API key, sent with Basic authentication, for a short-lived external_agent access token for a coding agent the key connected. The token acts for the key: it reaches only the key's workspace, with the key's scopes within the external_agent ceiling, and stops working when the key is disabled, expired or deleted. Nothing is stored; exchange again before the token expires. Agent tokens, people's tokens, and login, impersonation, invitation, agent-bound, company and global keys are refused.

post/agentTokens

Request

  • Base URL: https://api.mabl.com
  • URL: https://api.mabl.com/agentTokens
  • Auth: one of:
    • HTTP basic
    • API key in header Authorization

Request body

client_kind'mcp' | 'cli' required

Which kind of client an external agent (a coding agent a person or API key connected) acts through

Response

The external agent access token.

access_tokenstring required

An external_agent access token acting for the API key.

token_typestring required

Always Bearer.

expires_ininteger required

Seconds until the access token expires, at most 900 and never past the API key's expiry.

Changes

  • b602223aa51fRevision changes
    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

  • 91ff383fb7f9Revision changes
    • info

      endpoint added