---
title: "Mint a same-origin download token"
method: GET
path: "/download-token.php"
tags: ["Downloads"]
---

# Mint a same-origin download token

`GET /download-token.php`

Browser download flow endpoint. It requires a same-origin Referer and X-Requested-With: XMLHttpRequest. The token is used by /download.php.

## Headers

- `X-Requested-With` 'XMLHttpRequest', required
- `Referer` string, uri, required

## Response `200`

Download token response.

- object
  - `token` string, required

## Other responses

- `403` — Missing same-origin browser headers.

---

[API](https://skmtc.dev/postalcodes/apis/postalcodes-info-postal-code-reference-api.md) · [All operations](https://skmtc.dev/postalcodes/apis/postalcodes-info-postal-code-reference-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/postalcodes/postalcodes-info-postal-code-reference-api/revisions/d98a4c6d6ad6/schema)