--- title: "Create an app install" method: POST path: "/v1/apps/installs" --- # Create an app install `POST /v1/apps/installs` ## Request - Base URL: `https://api.stripe.com` - URL: `https://api.stripe.com/v1/apps/installs` - Auth: one of: - HTTP basic - HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates an app install. An account installs its own private app with its own key; public and testing installs are made from the Dashboard. An app developer or embedding platform acting on a connected account through `Stripe-Account` installs or reinstalls its app there. For a private app, creating an install installs the newest completed upload; when that version is already installed with nothing pending, the existing install is returned. ## Request body `application/x-www-form-urlencoded` - object - `app` string, required: The ID of the app to install. - `channel` 'private_live' | 'private_test' | 'public' | 'testing': The distribution channel to install from. Defaults to `public`. A private app must be installed on `private_test` or `private_live`, matching the mode of the API key. - `code_challenge` string: For OAuth apps, the PKCE code challenge used to issue the `auth_code` returned on the install. Must be 43 to 128 characters and contain only letters, numbers, `-`, `.`, `_`, and `~`. Only applies to installs made by the app developer or an embedding platform; ignored when an account installs its own private app. - `code_challenge_method` string: The method used to derive `code_challenge`. Required when `code_challenge` is provided, and must be `S256`. - `expand` string[]: Specifies which fields in the response should be expanded. ## Response `200` Successful response. - AppsInstall: An app install represents a Stripe App that is installed on an account. It reports the permissions, content security policy entries, and endpoints that the installing account has authorized, along with any that the app's latest version requests but the account has not authorized yet. Use the Install API to install, reauthorize, and uninstall apps, and to check the state of existing installs. - `account` string, required: The ID of the account that the app install belongs to. - `app` string, required: The ID of the app installed. - `approval_required` boolean, required: Whether the installer must authorize pending permissions, content security policy entries, or endpoints. For private apps, `approval_required` stays `false`; creating or reauthorizing the install through the API installs the newest completed upload and grants its permissions. - `auth_code` string, nullable: The authorization code for an oauth app install. - `channel` 'private_live' | 'private_test' | 'public' | 'review' | 'testing', required: The distribution channel associated with the app install. - `content_security_policy_granted` AppServiceResourceInstallContentSecurityPolicy, required - `connect_src` string[], required: The URLs that the app can make network requests to. - `image_src` string[], required: The URLs that the app can load images from. - `content_security_policy_pending` AppServiceResourceInstallContentSecurityPolicy, required - `connect_src` string[], required: The URLs that the app can make network requests to. - `image_src` string[], required: The URLs that the app can load images from. - `created` integer, required: Time at which the object was created. Measured in seconds since the Unix epoch. - `created_by` string, nullable: The ID of the embedding platform that created the install, if applicable. - `endpoints_granted` string[], required: The endpoint URLs authorized by the installer. - `endpoints_pending` string[], required: The endpoint URLs requested by the latest app version that the installer has not authorized. - `id` string, required: Unique identifier for the object. - `livemode` boolean, required: If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`. - `object` 'apps.install', required: String representing the object's type. Objects of the same type share the same value. - `permissions_granted` string[], required: The permissions authorized by the installer. - `permissions_pending` string[], required: The permissions requested by the latest app version that the installer has not authorized. - `status` 'install_failed' | 'installed' | 'installing' | 'uninstall_failed' | 'uninstalling', required: The status of the app install. ## Other responses - `default`: Error response. ## Changes > 186 revisions in range; 12 not diffed, 14 could not be searched. - **2026-09-25** `8b5c2f03d4cd`: 11 info - added the optional property `error/payment_intent/latest_charge/anyOf[subschema #2: Charge]/payment_method_details/anyOf[subschema #1: payment_method_details]/bancontact/generated_sepa_debit_mandate/anyOf[subschema #2: Mandate]/payment_method_details/card/india` to the response with the `default` status - added the optional property `error/payment_intent/latest_charge/anyOf[subschema #2: Charge]/payment_method_details/anyOf[subschema #1: payment_method_details]/card/mandate/anyOf[subschema #2: Mandate]/payment_method_details/card/india` to the response with the `default` status - added the optional property `error/payment_intent/latest_charge/anyOf[subschema #2: Charge]/payment_method_details/anyOf[subschema #1: payment_method_details]/ideal/generated_sepa_debit_mandate/anyOf[subschema #2: Mandate]/payment_method_details/card/india` to the response with the `default` status - added the optional property `error/payment_intent/latest_charge/anyOf[subschema #2: Charge]/payment_method_details/anyOf[subschema #1: payment_method_details]/sofort/generated_sepa_debit_mandate/anyOf[subschema #2: Mandate]/payment_method_details/card/india` to the response with the `default` status - …7 more - …this revision’s changelog is incomplete [Operation history](https://skmtc.dev/stripe/apis/spec3/changes/v1/apps/installs/post.md) --- [API](https://skmtc.dev/stripe/apis/spec3.md) - [All operations](https://skmtc.dev/stripe/apis/spec3/llms.txt) - [OpenAPI document](https://skmtc.dev/stripe/apis/spec3/revisions/585b581504ae?raw)