---
title: "Mint a US staff Bearer (service secret)"
method: POST
path: "/internal/mint-staff-token"
tags: ["internal"]
---

# Mint a US staff Bearer (service secret)

`POST /internal/mint-staff-token`

US-only in stg/prod. Bearer STAFF_REGION_TOKEN_SECRET (not the allocate secret). Upserts user + staff roles from Canada's current privileges at the given user.id and mints oauth2_token. Canada calls this after validating the Canada session.

## Request body

- MintStaffTokenRequest
  - `chef_display_name` string, nullable, required
  - `country_of_residence` string, nullable, required
  - `email` string, email, required
  - `first_name` string, required
  - `is_active` boolean, required
  - `is_chef` boolean, required
  - `is_data_reviewer` boolean, required
  - `last_name` string, required
  - `meal_admin` boolean, required
  - `review_level` string, nullable, required
  - `user_id` integer, required

## Response `200`

minted US Bearer

- StaffRegionTokenResponse
  - `access_token` string, required
  - `expires_in` integer, required
  - `region` 'us', required
  - `token_type` string, required
  - `user_id` integer, required

## Other responses

- `401` — missing or wrong service secret
- `404` — mint is not hosted on this deploy
- `409` — user.id or email conflict

## Changes

- **2026-09-24** `a61b77b30e63` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/changes/internal/mint-staff-token/post.md)

---

[API](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server.md) · [All operations](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/llms.txt) · [OpenAPI document](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/revisions/a61b77b30e63?raw)