---
title: "get app embed token by path"
method: GET
path: "/w/{workspace}/apps/embed_token/p/{path}"
tags: ["app"]
---

# get app embed token by path

`GET /w/{workspace}/apps/embed_token/p/{path}`

## Path parameters

- `workspace` string, required
- `path` string, required

## Query parameters

- `sdk_consent` boolean

## Response `200`

embed token

- EmbedTokenResponse
  - `token` string, nullable — Scoped token for the app. For sandboxed low-code apps this is the embed token handed to the opaque iframe. For a raw app it is the viewer-scoped frontend SDK token, returned only when the app is sandboxed, its policy declares frontend_sdk_scopes, and the request carries sdk_consent=true. Absent for anonymous viewers and whenever no token is needed.
  - `expiration` string, date-time, nullable — Expiration of the embed token.
  - `raw_app` boolean, required — Raw apps render single-iframe and skip the opaque-viewer indirection and the embed token entirely. A sandboxed one may still carry a token here: the viewer-scoped frontend SDK token, which is a different credential from the low-code embed token.
  - `sandbox` boolean, required — Publisher opted this app into sandbox isolation. When false the viewer runs the app same-origin with its full session.
  - `app_path` string, nullable — The resolved app path; the embedder uses it to scope the app's backing localStorage per app.
  - `workspace_id` string, nullable — The resolved workspace; pairs with app_path so apps at the same path in different workspaces don't share a localStorage store.
  - `sdk_scopes` string[], nullable — Sandboxed raw apps: scopes the app policy declares for the frontend SDK token. Null when the app is unsandboxed, however the policy reads. The viewer renders these in the permission prompt; token stays absent until the endpoint is re-called with sdk_consent=true.
  - `viewer_email` string, nullable — The caller's own email, returned alongside sdk_scopes so the viewer can key its stored "do not ask again" per person.

## Changes

> 176 revisions in range; 4 could not be searched.

- **2026-08-03** `e75591f42c41` — 3 info
  - added the new optional `query` request parameter `sdk_consent`
  - added the optional property `sdk_scopes` to the response with the `200` status
  - added the optional property `viewer_email` to the response with the `200` status
- **2026-06-23** `2ec6821b6fb1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/windmill/apis/windmill-api/changes/w/:workspace/apps/embed_token/p/:path/get.md)

---

[API](https://skmtc.dev/windmill/apis/windmill-api.md) · [All operations](https://skmtc.dev/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/windmill/windmill-api/revisions/7b281701c340/schema)