---
title: "Mint End User Token"
method: POST
path: "/api/v1/serving-identity/end-user-token"
tags: ["authed"]
---

# Mint End User Token

`POST /api/v1/serving-identity/end-user-token`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/serving-identity/end-user-token`
- Auth: none declared

Mint a short-lived end-user JWT identifying the caller, as a member
of their active organization, to the dashboard's own embedded
assistant — the dogfood copy of a customer backend's ~5-line mint.
The signing org is not the caller's active org: the embedded assistant
belongs to the one workspace owning DASHBOARD_ASSISTANT_PUBLISHABLE_KEY,
resolved on every call so a revoked or rotated embed fails loudly (503)
instead of signing for a stale workspace. Signed HS256 with that org's
end-user JWT secret (created on first use), expiring in one hour.

Org-scoped and gated on assistant.use like every dashboard route,
because the token names who pays (TEA-1326): the end user is
"<profile uuid>:<organization uuid>" and paying_organization_id is the
active org, whose own funding the assistant's turns spend. The token is
never a capability to act.

## Response `200`

Successful Response

- EndUserTokenResponse
  - `token` string, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)