# Mint a public run token POST /v1/tokens/public ```sh curl --request POST \ --url https://example.com/v1/tokens/public \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "runIds": [ "example" ], "expiresInSeconds": 1 }' ``` A short-lived, read-only token for up to 50 runs (and their descendants), to hand to a browser: it can only call `GET /v1/runs/{runId}/progress` and `GET /v1/runs/{runId}/progress/stream`. Stateless: it cannot be revoked one by one, so keep lifetimes short. Mounted when the deployment issues public run tokens. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)** ## Parameters ### Header Parameters **Idempotency-Key** string \>= 1 characters Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per `docs/API-ROUTE-CONVENTIONS.md` §3.1). A retry sent while the first request still runs is answered `409 idempotency-key-in-flight` with `Retry-After`, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets `409 idempotency-key-replay-withheld`, with the first request’s status and when it succeeded (from 0.1.5). ## Request Bodyrequired application/json object **runIds** required The runs the token may read; their descendants are readable too. Array\ \>= 1 items <= 50 items **expiresInSeconds** Lifetime; the deployment default (15 minutes) when absent. integer \>= 1 <= 86400 ##### Examplegenerated ```json { "runIds": [ "example" ], "expiresInSeconds": 1 } ``` ## Responses ### 201 Token minted. application/json object **token** required The public run token (`kgi_pt_…`). string **expiresAt** required string format: date-time **runIds** required Array\ ##### Examplegenerated ```json { "token": "example", "expiresAt": "2026-04-15T12:00:00Z", "runIds": [ "example" ] } ``` ### 400 Malformed body, or `expiresInSeconds` above the deployment maximum. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 403 The caller may not read one of the runs (`permission-denied`). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 404 A run does not exist under this tenant (`run-not-found`). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 409 Idempotency-Key reused with a different body (`idempotency-key-body-mismatch`), or a retry of a request that succeeded: its answer carried a secret, which isn’t kept (`idempotency-key-replay-withheld`, with its `status` and `at`). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 413 The request body is over the API’s limit (`request-too-large`; `details.maxBytes` says how much). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 500 Server error (unmapped domain code or framework crash). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [Security](https://docs.kindgi.com/v0.1.9/concepts/security.md) - [Error code `idempotency-key-body-mismatch`](https://docs.kindgi.com/v0.1.9/reference/errors.md#idempotency-key-body-mismatch) - [Error code `idempotency-key-replay-withheld`](https://docs.kindgi.com/v0.1.9/reference/errors.md#idempotency-key-replay-withheld) - [Error code `permission-denied`](https://docs.kindgi.com/v0.1.9/reference/errors.md#permission-denied) - [Error code `request-too-large`](https://docs.kindgi.com/v0.1.9/reference/errors.md#request-too-large) - [Error code `run-not-found`](https://docs.kindgi.com/v0.1.9/reference/errors.md#run-not-found) - [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)