Skip to main content
POST
Create a visitor token

Authorizations

Authorization
string
header
required

An API token for one organization. You create and revoke tokens in the dashboard. A token scoped to one App can reach only that App, so give that kind of token to an agent. An organization-wide token can create a short-lived one with POST /api/tokens.

Scopes

apps:write
OAuth

Change the organization's Apps: edit files, run commands, deploy, and manage Secrets.

apps:write
DPoP

Headers

Idempotency-Key
string

A key for this request, up to 200 printable characters. The request stores nothing, so a retry makes a new one whatever the key; the API returns the key in the Idempotency-Key response header.

Required string length: 1 - 200

Path Parameters

id
string
required

A unique ID that starts with app_.

Pattern: ^app_[0-9A-Za-z]{24}$
Example:

"app_Zj7XhMgplmTJcp5Dk4vcYuk0"

Response

The visitor token.

token
string
required

The visitor token. Send it in the X-Judt-Access-Token header or the access_token URL parameter.

expires_at
string<date-time>
required

When the token expires, five minutes after it was created.

Example:

"2026-10-03T14:01:30.000Z"