---
title: "Mint a secrets-bearing export token (internal-only)"
method: POST
path: "/internal/exports/mint"
tags: ["Export", "Internal"]
---

# Mint a secrets-bearing export token (internal-only)

`POST /internal/exports/mint`

## Request

- Base URL: `https://api.percher.run`
- URL: `https://api.percher.run/internal/exports/mint`
- Auth: API key in header `X-Internal-Secret`

Service-to-service. The dashboard server action is the only legitimate caller: it verifies the BetterAuth session, re-confirms the user's password fresh, then calls this endpoint. Returns `rawToken` (the credential) and `tokenId` — the caller assembles the user-facing download URL using its own knowledge of the public API origin. The internal route deliberately does not return a `downloadUrl` because it cannot know which public host the user should be sent to.

## Request body

- object
  - `userId` string, required
  - `appId` string, required
  - `includeSecrets` boolean, required
  - `deliveryKind` 'dashboard' | 'cli' | 'mcp' | 'sunset_email'

## Response `201`

Token minted

- object
  - `tokenId` string, required
  - `rawToken` string, required
  - `expiresAt` string, date-time, required
  - `ttlSeconds` integer, required
  - `includeSecrets` boolean, required

## Other responses

- `401`: Missing or invalid X-Internal-Secret
- `404`: App not found for this user
- `429`: Daily mint rate limit reached

---

[API](https://skmtc.dev/percher/apis/percher-api.md) · [All operations](https://skmtc.dev/percher/apis/percher-api/llms.txt) · [OpenAPI document](https://skmtc.dev/percher/apis/percher-api/revisions/d9e7089c21e5?raw)