---
title: "Create a connect token for a sandbox run"
method: POST
path: "/sandboxes/{sandboxId}/runs/{operation}/token"
tags: ["Sandboxes"]
---

# Create a connect token for a sandbox run

`POST /sandboxes/{sandboxId}/runs/{operation}/token`

## Request

- Base URL: `https://api.render.com/v1`
- URL: `https://api.render.com/v1/sandboxes/{sandboxId}/runs/{operation}/token`
- Auth: HTTP bearer

Mint a short-lived, capability-scoped connect token that authorizes a
single run operation against the specified sandbox. The response contains
the sandbox URI where the caller sends the command with the token as a bearer credential.

409 with `code: sandbox_group_suspended` if the sandbox group is suspended.

## Parameters

- `#/paths/~1sandboxes~1{sandboxId}/get/parameters/0` (unresolved $ref)

## Request body

- object: Optional body when minting a run connect token. `command` is stored on the exec timeline (truncated to 4KB); the full command is still sent to the sandbox proxy when executing.
  - `command` string: Command text for the sandbox event timeline.

## Response `201`

Connect token minted.

- object: A minted connect token and the sandbox-proxy endpoint to invoke with it. Send the request (and body, where the operation takes one) to `uri` using `method`, with `token` as a bearer credential.
  - `executionId` string, required: Identifier for this execution.
  - `token` string, required: Short-lived bearer token authorizing exactly this operation against the sandbox.
  - `uri` string, uri, required: The sandbox-proxy endpoint to invoke.
  - `method` string, required: HTTP method to use against `uri`.
  - `expiresAt` string, date-time, required: When `token` stops being valid. Start the run before this time.

## Other responses

- `400`: The request could not be understood by the server.
- `401`: Authorization information is missing or invalid.
- `403`: You do not have permissions for the requested resource. If a scoped API token does not satisfy the endpoint's minimum scope requirements, the response has code insufficient_token_scope and its message lists all minimum required scopes. Broader scopes that include their permissions also satisfy the requirements. Passing this check does not guarantee access to the requested resource or to conditional operations.
- `404`: Unable to find the requested resource.
- `429`: Rate limit has been surpassed. Rate-limited endpoints also return `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` on successful responses so clients can track their remaining quota.
- `500`: An unexpected server error has occurred.
- `503`: Server currently unavailable.

## Changes

- **2026-11-03** `6ac5d3d47362`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/render/apis/render-public-api/changes/sandboxes/:sandboxId/runs/:operation/token/post.md)

---

[API](https://skmtc.dev/render/apis/render-public-api.md) - [All operations](https://skmtc.dev/render/apis/render-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/render/apis/render-public-api/revisions/6ac5d3d47362?raw)