---
title: "Mint a connect token."
method: POST
path: "/v1/machines/{id}/connect-token"
tags: ["machines"]
---

# Mint a connect token.

`POST /v1/machines/{id}/connect-token`

## Request

- Base URL: `https://api.smolmachines.com`
- URL: `https://api.smolmachines.com/v1/machines/{id}/connect-token`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/smolmachines/apis/smolfleet-api/docs/v1/machines/:id/connect-token/post.ts> (a function with typed inputs; its response is checked against the schema)

Returns a short-lived token that opens only this machine's connect bridge, `/v1/machines/{id}/connect/{port}`, and, by default, its descendants. Pass `port` to limit access to one published guest port, and `includeDescendants: false` to exclude branches. It is refused on every other endpoint, expires after `ttlSeconds` (3600 by default, never past the minting key's own expiry), and can be sent as the `access_token` query parameter on a WebSocket upgrade, so a client that cannot set headers, such as a DevTools client, can still connect. Requires the `machine:exec` scope.

## Path parameters

- `id` string, required

## Request body

- CreateConnectTokenRequest: Body for `POST /v1/machines/{id}/connect-token`. Empty is fine.
  - `includeDescendants` boolean, nullable: Whether branches of the target machine are reachable. Omitted keeps the existing behavior; pass false to confine access to this machine.
  - `port` integer, nullable: Restrict the credential to one published guest port. Omitted means all published ports for compatibility with existing clients.
  - `ttlSeconds` integer, nullable: How long the token lasts, in seconds: 60 to 86400, 3600 when left out. It never outlives the API key that mints it.

## Response `201`

Connect token minted; the token is in this response and nowhere else

- ConnectToken: A connect token: a short-lived credential that opens only `/v1/machines/{id}/connect/{port}` on its selected machine and ports, optionally including descendants. Send it as a Bearer token, or as the `access_token` query parameter on a WebSocket upgrade, so a client that cannot set headers (a DevTools client, a browser `WebSocket`) can still connect.
  - `expiresAt` string, required: RFC 3339 time after which the token is refused.
  - `id` string, required: API key id, for revoking this token via `DELETE /v1/apikeys/{id}`.
  - `machineId` string, required: The machine the token was minted for.
  - `token` string, required

## Other responses

- `401`: Missing or invalid API key
- `403`: Key lacks the machine:exec scope
- `404`: Machine not found
- `422`: ttlSeconds is out of range
- `429`: Rate limited; retry after the Retry-After header
- `500`: Internal error

## Changes

- **2026-10-16** `bc31fc04a568`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/smolmachines/apis/smolfleet-api/changes/v1/machines/:id/connect-token/post.md)

---

[API](https://skmtc.dev/smolmachines/apis/smolfleet-api.md) - [All operations](https://skmtc.dev/smolmachines/apis/smolfleet-api/llms.txt) - [OpenAPI document](https://skmtc.dev/smolmachines/apis/smolfleet-api/revisions/bc31fc04a568?raw)