---
title: "Nblock dashboard will call these endpoints instead of the normal ones due to it is not providing the AppSecret and operates in god mode. A JWT approach would be better and remove the need for this internal traffic"
method: POST
path: "/v1/account/internal/app"
tags: ["internal"]
---

# Nblock dashboard will call these endpoints instead of the normal ones due to it is not providing the AppSecret and operates in god mode. A JWT approach would be better and remove the need for this internal traffic

`POST /v1/account/internal/app`

## Request

- Base URL: `https://api.thebridge.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.thebridge.dev/v1/account/internal/app`
- Auth: none declared. Required headers: `x-tenant-id`

## Headers

- `x-tenant-id` string, required

## Request body

- CreateAppRequestDto
  - `name` string, required
  - `domain` string: Just for internal use, should be left blank for auto generation
  - `apiUrl` string
  - `uiUrl` string
  - `webhookUrl` string
  - `logo` string
  - `websiteUrl` string
  - `privacyPolicyUrl` string
  - `termsOfServiceUrl` string
  - `metaData` object
  - `defaultCallbackUri` string, uri: TBP-764 — the app's sign-in callback address, optional. When given it is registered as the only redirect URI and made the default callback; when omitted the app starts with none and sign-in fails with NBLOCKS_NO_CALLBACK_URI until one is added.

## Response `201`

- CreateAppResponseDto
  - `apiKey` string, required: Your unique api key to provide in future calls. Will never be revealed again
  - `app` GetAppResponseDto, required
    - `id` string, required: Unique ID (Read only)
    - `name` string, required: Name of the app
    - `domain` string, required: Unique domain name of the app (Read only)
    - `apiUrl` string, required: URL to your api (to receive webhooks etc). **Must be HTTPS**
    - `uiUrl` string, required: URL to your frontend app (for onboarding redirects etc). **Must be HTTPS**
    - `logo` string, required: URL to your logo
    - `websiteUrl` string, required: URL to your website or landing page. E.g. Branded emails will link to this URL, checkout process will redirect to `/payment-success` and `/payment-cancel`
    - `webhookUrl` string, required: Events like tenant and user updates will be sent to this webhook url
    - `privacyPolicyUrl` string, required: URL to a page on your website containing a Privacy policy for your app users. E.g. checkout process will link to this url.
    - `termsOfServiceUrl` string, required: URL to a page on your website containing a Terms of service for your app users. E.g. checkout process will link to this url.
    - `emailSenderName` string: Emails sent from Nblocks will have this sender name
    - `emailSenderEmail` string: Emails sent from Nblocks will have this sender email. You'll have to verify this email before
    - `paymentsAutoRedirect` boolean, required
    - `stripeEnabled` boolean, required: Boolean value telling the user if Stripe is enabled
    - `stripeSetupStatus` 'completed' | 'pending' | 'failed': Status of Stripe setup process
    - `stripeSetupError` string, nullable: Error message if Stripe setup failed
    - `stripeLastWebhookAt` string, date-time, nullable: Last time a Stripe webhook event was received and verified. Null means none has been verified yet.
    - `stripeLastWebhookRejectedAt` string, date-time, nullable: Last time a Stripe webhook event was rejected
    - `stripeLastWebhookRejectionReason` string, nullable: Why the last Stripe webhook event was rejected: `no_signing_secret`, `signature_mismatch` or `raw_body_missing`
    - `stripeWebhookRejectionStreak` number: Rejected Stripe webhook events since the last verified one, counted at most once per minute. 3 or more means events are being rejected persistently.
    - `allowedTokenPrivileges` string[], nullable: Allowed privileges for API tokens
    - `passkeysEnabled` boolean, required: Boolean value telling the user if passkeys login is enabled
    - `mfaEnabled` boolean, required: Boolean value telling the user if MFA is enabled
    - `magicLinkEnabled` boolean, required: Boolean value telling the user if Login with Magic Link is enabled
    - `googleSsoEnabled` boolean, required: Boolean value telling the user if Google Social login / SSO is enabled
    - `linkedinSsoEnabled` boolean, required: Boolean value telling the user if LinkedIn Social login / SSO is enabled
    - `azureAdSsoEnabled` boolean, required: Boolean value telling the user if Azure AD SSO is enabled
    - `azureMarketplaceEnabled` boolean, required: Boolean value telling the user if Azure marketplace is enabled
    - `appleSsoEnabled` boolean, required: Boolean value telling the user if Apple Social login / SSO is enable
    - `githubSsoEnabled` boolean, required: Boolean value telling the user if Github Social login / SSO is enable
    - `facebookSsoEnabled` boolean, required: Boolean value telling the user if Facebook Social login / SSO is enable
    - `onboardingFlow` 'B2B' | 'B2C', required: Configure how users will be onboarded
    - `tenantSelfSignup` boolean, required: Allow self signup (relates to cloud views, payment providers etc)
    - `redirectUris` string[], required: Allowed redirect uris
    - `allowedOrigins` string[], required: Allowed origins for SDK mode (CORS + origin validation)
    - `defaultCallbackUri` string, required: Default handover/callback uri used by Nblocks
    - `accessTokenTTL` number, required: TTL for access token, default 1 hour
    - `refreshTokenTTL` number, required: TTL for refresh token, default 1 week

---

[API](https://skmtc.dev/thebridge/apis/bridge-api.md) · [All operations](https://skmtc.dev/thebridge/apis/bridge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thebridge/apis/bridge-api/revisions/290fffcb3d80?raw)