---
title: "Set or rotate the app launch token"
method: POST
path: "/api/v1/apps/{app_id}/launch-token"
tags: ["Apps", "apps-launch-token"]
---

# Set or rotate the app launch token

`POST /api/v1/apps/{app_id}/launch-token`

## Request

- Base URL: `https://cloud-api.phala.com`
- URL: `https://cloud-api.phala.com/api/v1/apps/{app_id}/launch-token`
- Auth: none declared
- TypeScript: <https://skmtc.dev/phala/apis/phala-cloud-api/docs/api/v1/apps/:app_id/launch-token/post.ts> (a function with typed inputs; its response is checked against the schema)

Sets the app's launch token, generating one when the body omits it, and returns the plaintext and its hash once. CVMs keep booting with their current compose: update each CVM's requirements.launch_token_hash to the returned hash before its next boot, or it fails closed. Phala Cloud and the node operator can read the token, so it protects only against parties who know the public compose.

## Path parameters

- `app_id` string, required: Hex app identifier

## Request body

- SetLaunchTokenRequest
  - `launch_token` string, nullable: Token to set (at least 32 bytes). Omit to have Phala Cloud generate one.

## Response `200`

New launch token and hash

- LaunchTokenResponse
  - `launch_token` string, required: The app's new launch token. Returned only here, once.
  - `launch_token_hash` string, required: Value for compose_file.requirements.launch_token_hash of every CVM of the app

## Other responses

- `401`: Not authenticated
- `403`: No permission to update the app
- `404`: App not found
- `422`: Token shorter than 32 bytes

## Changes

- **2026-11-07** `c71a8dc90391`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/phala/apis/phala-cloud-api/changes/api/v1/apps/:app_id/launch-token/post.md)

---

[API](https://skmtc.dev/phala/apis/phala-cloud-api.md) - [All operations](https://skmtc.dev/phala/apis/phala-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/phala/apis/phala-cloud-api/revisions/c71a8dc90391?raw)