Tokens

Create an App token

Creates an API token that reaches only one App, for up to 24 hours. Give it to an agent or an MCP client that should work on that App and nothing else. The token can’t reach other Apps, create Apps, or create tokens. It stops working at expires_at, and never outlives the token that created it, so it can’t extend that token’s access.

Only an organization-wide API token can create one. The response is the only place the token’s value appears, so store it before you continue. If the response is lost, retry with the same Idempotency-Key: the retry returns the same token with a new value, and the earlier value stops working. To revoke a token before it expires, use the dashboard.

POST

api

tokens

Create an App token

curl --request POST \
  --url https://api.judt.ai/api/tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "app_id": "<string>",
  "expires_in": 300
}
'

import requests

url = "https://api.judt.ai/api/tokens"

payload = {
    "name": "<string>",
    "app_id": "<string>",
    "expires_in": 300
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({name: '<string>', app_id: '<string>', expires_in: 300})
};

fetch('https://api.judt.ai/api/tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.judt.ai/api/tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'app_id' => '<string>',
    'expires_in' => 300
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.judt.ai/api/tokens"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.judt.ai/api/tokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.judt.ai/api/tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "organization_id": "<string>",
  "app_id": "<string>",
  "name": "<string>",
  "preview": "<string>",
  "expires_at": "2026-10-03T14:01:30.000Z",
  "last_used_at": "2026-10-03T14:01:30.000Z",
  "created_at": "2026-10-03T14:01:30.000Z",
  "token": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

Authorizations

Authorization

string

header

required

An API token for one organization. You create and revoke tokens in the dashboard. A token scoped to one App can reach only that App, so give that kind of token to an agent. An organization-wide token can create a short-lived one with POST /api/tokens.

Headers

Idempotency-Key

string

A key that identifies this request for retries, up to 200 printable characters. A retry with the same key and input returns the first request's result instead of repeating the work. If you omit the key, the API generates one and returns it in the Idempotency-Key response header.

Required string length: 1 - 200

Body

application/json

name

string

required

A name for the token, up to 100 characters. The dashboard lists the token by this name.

Required string length: 1 - 100

app_id

string

required

The App that the token reaches. The token can't reach any other App or create Apps.

Pattern: ^app_[0-9A-Za-z]{24}$

expires_in

integer

default:3600

How long the token works, in seconds, from 60 to 86400 (24 hours). Default: 3600. The token never outlives the token that created it.

Required range: 60 <= x <= 86400

Example:

300

Response

The new token, with its value.

string

required

The token's ID, which starts with tok_.

organization_id

string

required

The organization that the token belongs to.

app_id

string | null

required

The one App an App-scoped token reaches; null for the whole organization

name

string

required

The token's name.

preview

string

required

judt_*** and the token's last four characters, to tell tokens apart.

expires_at

string<date-time> | null

required

When the token stops working; null if it never expires.

Example:

"2026-10-03T14:01:30.000Z"

last_used_at

string<date-time> | null

required

When the token was last used, to the minute; null if it hasn't been used.

Example:

"2026-10-03T14:01:30.000Z"

created_at

string<date-time>

required

Example:

"2026-10-03T14:01:30.000Z"

token

string

required

The token. Send it as a bearer token in the Authorization header, to the API or the MCP server. This is the only response that includes it.

Create an App token

curl --request POST \
  --url https://api.judt.ai/api/tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "app_id": "<string>",
  "expires_in": 300
}
'

import requests

url = "https://api.judt.ai/api/tokens"

payload = {
    "name": "<string>",
    "app_id": "<string>",
    "expires_in": 300
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({name: '<string>', app_id: '<string>', expires_in: 300})
};

fetch('https://api.judt.ai/api/tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.judt.ai/api/tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'app_id' => '<string>',
    'expires_in' => 300
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.judt.ai/api/tokens"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.judt.ai/api/tokens")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.judt.ai/api/tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"app_id\": \"<string>\",\n  \"expires_in\": 300\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "organization_id": "<string>",
  "app_id": "<string>",
  "name": "<string>",
  "preview": "<string>",
  "expires_at": "2026-10-03T14:01:30.000Z",
  "last_used_at": "2026-10-03T14:01:30.000Z",
  "created_at": "2026-10-03T14:01:30.000Z",
  "token": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "request_id": "<string>",
    "detail": "<string>"
  }
}

Overview

Account

Apps

Tokens

Secrets

Files

Sandbox

Deployments

Monitoring

Templates

Agents

Feedback

Create an App token

Authorizations

Headers

Body

Response