Projects

Mint a short-lived project token (grant-key-capable)

Mints a SHORT-LIVED project token. This is the cold-restart recovery path: an agent that lost its local state but still holds a grant key, wallet, or workload identity can call this with no human present and resume work. Unlike credential creation, a grant key CAN do this — the token expires, so it can never become a durable root.

post/projects/v1/{project_id}/tokens

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/projects/v1/{project_id}/tokens
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer
    • HTTP bearer

Path parameters

project_idstring required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

kind'anon' | 'service'

Response

Minted. Carries the secret ONCE, with expires_in seconds.

credential_idstring
project_idstring
kind'anon' | 'service'
namestring
created_atstring date-time
last_used_atstring date-time nullable
expires_atstring date-time nullable
revoked_atstring date-time nullable
revoked_reasonstring nullable
replacement_ofstring nullable
secretstring

The credential secret, returned EXACTLY ONCE and never recoverable afterwards. Store it immediately. Responses carrying it are sent with Cache-Control: no-store and must not be persisted to any client-side result cache.

next_actionsobject[]
expires_ininteger

Example response

{
  "expires_in": 900
}

Changes

No recorded changes to this operation across all 1 revision of this API.