---
title: "Mint a one-time export download token"
method: POST
path: "/apps/{appRef}/export/mint"
tags: ["Export"]
---

# Mint a one-time export download token

`POST /apps/{appRef}/export/mint`

## Request

- Base URL: `https://api.percher.run`
- URL: `https://api.percher.run/apps/{appRef}/export/mint`
- Auth: HTTP bearer

Returns a single-use download URL valid for 15 minutes. The raw token is never persisted server-side — only sha256(token) is stored. Re-downloading requires a fresh mint. Rate-limited to 10 mints per app per user per 24h.

This route hard-rejects `includeSecrets: true` with 400. Secrets export is browser-only and goes through the dashboard's password-confirm flow, which calls the internal `/internal/exports/mint` endpoint. The CLI, MCP, and any bearer-token client cannot produce a bundle containing env values.

## Path parameters

- `appRef` string, required

## Request body

- object
  - `deliveryKind` 'dashboard' | 'cli' | 'mcp' | 'sunset_email'
  - `includeSecrets` boolean: Must be omitted or `false`. Setting to `true` returns 400.

## Response `201`

Token minted

- object
  - `tokenId` string
  - `downloadUrl` string, uri
  - `expiresAt` string, date-time
  - `ttlSeconds` integer
  - `includeSecrets` boolean

## Other responses

- `400`: includeSecrets=true is not allowed on this route
- `404`: App not found
- `429`: Daily mint rate limit reached

---

[API](https://skmtc.dev/percher/apis/percher-api.md) · [All operations](https://skmtc.dev/percher/apis/percher-api/llms.txt) · [OpenAPI document](https://skmtc.dev/percher/apis/percher-api/revisions/d9e7089c21e5?raw)