---
title: "Mint a short-lived project token (grant-key-capable)"
method: POST
path: "/projects/v1/{project_id}/tokens"
tags: ["Projects"]
---

# Mint a short-lived project token (grant-key-capable)

`POST /projects/v1/{project_id}/tokens`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/tokens`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

Mints a SHORT-LIVED project token. This is the cold-restart recovery path: an agent that lost its local state but still holds a grant key, wallet, or workload identity can call this with no human present and resume work. Unlike credential creation, a grant key CAN do this — the token expires, so it can never become a durable root.

## Path parameters

- `project_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `kind` 'anon' | 'service'

## Response `201`

Minted. Carries the secret ONCE, with `expires_in` seconds.

- object
  - `credential_id` string
  - `project_id` string
  - `kind` 'anon' | 'service'
  - `name` string
  - `created_at` string, date-time
  - `last_used_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `revoked_at` string, date-time, nullable
  - `revoked_reason` string, nullable
  - `replacement_of` string, nullable
  - `secret` string: The credential secret, returned EXACTLY ONCE and never recoverable afterwards. Store it immediately. Responses carrying it are sent with `Cache-Control: no-store` and must not be persisted to any client-side result cache.
  - `next_actions` object[]
  - `expires_in` integer

## Other responses

- `403`: Not authorized on this project

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)