ApiCredentials

Mint Api Credential Token

Mint a machine token for this credential without touching the client_secret (the alternative to the POST /oauth/token client_credentials exchange, which stays at 15-day tokens). The token acts strictly for the owning entity with the credential's scopes, and the token string appears exactly once, in this response. Lifetime is chosen at mint: expires_in_days 30, 90 or 365 (default), or 0 for non-expiring. Non-expiring tokens live until revoked (DELETE /oauth-tokens/{id}) or the credential is deleted — expiry is not the cleanup path. Rotating the secret does NOT revoke these tokens.

post/api-credentials/{id}/tokens

Request

  • Base URL: https://api.purplegrain.com/api/v1
  • URL: https://api.purplegrain.com/api/v1/api-credentials/{id}/tokens
  • Auth: HTTP bearer

Path parameters

idstring required

The OAuth client_id (application uid).

Request body

Response

Minted — the token string is shown here and never again.

Example response

{
  "data": {
    "type": "oauth-token"
  }
}

Changes

No recorded changes to this operation across all 4 revisions of this API.