SMsmolmachines
machines

Mint a connect token.

Changed on

Returns a short-lived token that opens only this machine's connect bridge, /v1/machines/{id}/connect/{port}, and, by default, its descendants. Pass port to limit access to one published guest port, and includeDescendants: false to exclude branches. It is refused on every other endpoint, expires after ttlSeconds (3600 by default, never past the minting key's own expiry), and can be sent as the access_token query parameter on a WebSocket upgrade, so a client that cannot set headers, such as a DevTools client, can still connect. Requires the machine:exec scope.

post/v1/machines/{id}/connect-token

Request

Path parameters

idstring required

Machine id

Request body

includeDescendantsboolean nullable

Whether branches of the target machine are reachable. Omitted keeps the existing behavior; pass false to confine access to this machine.

portinteger nullable

Restrict the credential to one published guest port. Omitted means all published ports for compatibility with existing clients.

ttlSecondsinteger nullable

How long the token lasts, in seconds: 60 to 86400, 3600 when left out. It never outlives the API key that mints it.

Response

Connect token minted; the token is in this response and nowhere else

expiresAtstring required

RFC 3339 time after which the token is refused.

idstring required

API key id, for revoking this token via DELETE /v1/apikeys/{id}.

machineIdstring required

The machine the token was minted for.

tokenstring required

Changes