---
title: "Mint Import Token"
method: POST
path: "/saved/import-token"
tags: ["saved"]
---

# Mint Import Token

`POST /saved/import-token`

Mint the least-privilege token the iOS share extension stores in a shared
Keychain group and sends to POST /saved/import. It is scoped to
`saved:import` only, so a leak can't touch the rest of the account, and it
replaces any prior share-extension token for this user so exactly one is
ever live. The app re-mints when its stored copy is missing or near expiry.

Guests get a token too: a guest has a real backend `user_id`, and the import
path already accepts a guest's token, so the share extension works for
not-signed-in users without forcing a login first.

## Headers

- `x-installation-id` string, nullable

## Response `200`

Successful Response

- ImportTokenOut
  - `token` string, required
  - `expires_at` string, date-time, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/stardrift/apis/fastapi.md) · [All operations](https://skmtc.dev/stardrift/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stardrift/fastapi/revisions/00746572572a/schema)