---
title: "Turso token for app owner (Cloud App Host only)"
method: POST
path: "/v1/cloud/apps/runtime/db-token"
tags: ["v1", "Cloud Infrastructure"]
---

# Turso token for app owner (Cloud App Host only)

`POST /v1/cloud/apps/runtime/db-token`

## Request

- Base URL: `https://memory.papr.ai`
- URL: `https://memory.papr.ai/v1/cloud/apps/runtime/db-token`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

## Request body

- AppRuntimeDbTokenRequest
  - `external_user_id` string, nullable: Parse _User.objectId of the acting user (desktop OAuth). Used for ownership-scoped cloud operations instead of the API key user.
  - `namespaceId` string, required
  - `slug` string, required
  - `paprApiKey` string, nullable
  - `shareToken` string, nullable
  - `database` string, required: Turso database short name: j-{jobId8} (job-owned), d-{dbId8} (standalone), or {base}-u-{userId8} (per-user)
  - `clientTables` string[], nullable: Browser-SQL token: only these tables are reachable (Turso-enforced). Omit for the full owner token used by the host's own bookkeeping.
  - `clientMode` string: With clientTables: read (read-only), write (CRUD if caller can write), ddl (write + CREATE TABLE).

## Response `200`

Successful Response

- DatabaseTokenResponse
  - `tursoUrl` string, required
  - `authToken` string, required
  - `expiresAt` string, date-time, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-17** `85b2953e02c4`: 2 info
  - added the new optional request property `clientMode`
  - added the new optional request property `clientTables`
- **2026-10-16** `0e7a5c0d125d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/papr-ai/apis/papr-memory-api/changes/v1/cloud/apps/runtime/db-token/post.md)

---

[API](https://skmtc.dev/papr-ai/apis/papr-memory-api.md) - [All operations](https://skmtc.dev/papr-ai/apis/papr-memory-api/llms.txt) - [OpenAPI document](https://skmtc.dev/papr-ai/apis/papr-memory-api/revisions/6fc381dc78b3?raw)