> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.runtype.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.runtype.com/_mcp/server. # Create client token POST https://api.runtype.com/v1/client-tokens Content-Type: application/json Create a new client token for browser-to-API communication. Returns the plain token value once. Reference: https://docs.runtype.com/api-reference/runtype-api/client-tokens/create-client-token ## Authentication - `Authorization` header (bearer token, required) — API key or Clerk session token ## Servers - `https://api.runtype.com` (Production, default) - `https://api.runtype-staging.com` (Staging) ## Request ### Body (application/json) This endpoint expects an object. - `allowedOrigins` (list of string, required) — Allowed request origins for this token. Each entry is an exact origin (https://app.example.com), a wildcard subdomain (https://*.example.com), '*' for all origins, or the literal 'native' — a sentinel that admits requests carrying NO Origin header (native mobile apps). A token with 'native' has effectively no origin protection and relies on its capability scope. - `name` (string, required) - `agentIds` (list of string, optional, default: []) - `config` (map from string to any, optional, default: {}) - `defaultFlowId` (string, optional) - `environment` (enum, optional, default: live) - Allowed values: `test`, `live` - `flowIds` (list of string, optional, default: []) - `maxMessagesPerSession` (double, optional, default: 100) - `pinToVersion` (string, optional, default: latest) — Legacy widget-version mode: 'latest' or 'published'. It has never selected an agent version and still does not. An agent version id (agentver_...) is rejected on create; use targetVersionId to pin a version or targetAlias to follow a release alias. An update may echo back the value already stored. - `productSurfaceId` (string, optional) - `rateLimitPerHour` (double, optional, default: 100) - `rateLimitPerMinute` (double, optional, default: 10) - `revealOnce` (boolean, optional) - `sessionIdleTimeoutMinutes` (double, optional, default: 30) - `targetAlias` (string, optional, nullable) — Release alias this token follows. Re-resolved on every admission, so a deploy at that alias changes what the token runs. Mutually exclusive with targetVersionId. - `targetVersionId` (string, optional, nullable) — Exact agent version this token runs. Never re-resolved. Mutually exclusive with targetAlias, and the token must carry exactly one agent id. ## Response ### 201 Created client token - `clientToken` (V1ClientTokensPostResponsesContentApplicationJsonSchemaClientToken, required) - `token` (string, required) - `warnings` (list of V1ClientTokensPostResponsesContentApplicationJsonSchemaWarningsItems, required) ## Errors ### 400 Bad Request Error Validation error - `error` (string, required) - `code` (string, optional) — Stable error code. `insufficient_scope` marks an API key that lacks a scope this request needs. - `details` (list of ErrorDetailsItems, optional) - `requiredScopes` (list of string, optional) — On `insufficient_scope`: every API key scope this request needs. ### 401 Unauthorized Error Unauthorized - `error` (string, required) - `code` (string, optional) — Stable error code. `insufficient_scope` marks an API key that lacks a scope this request needs. - `details` (list of ErrorDetailsItems, optional) - `requiredScopes` (list of string, optional) — On `insufficient_scope`: every API key scope this request needs. ### 403 Forbidden Error Insufficient permissions - `error` (string, required) - `code` (string, optional) — Stable error code. `insufficient_scope` marks an API key that lacks a scope this request needs. - `details` (list of ErrorDetailsItems, optional) - `requiredScopes` (list of string, optional) — On `insufficient_scope`: every API key scope this request needs. ### 404 Not Found Error Referenced flow not found - `error` (string, required) - `code` (string, optional) — Stable error code. `insufficient_scope` marks an API key that lacks a scope this request needs. - `details` (list of ErrorDetailsItems, optional) - `requiredScopes` (list of string, optional) — On `insufficient_scope`: every API key scope this request needs. ### 500 Internal Server Error Internal server error - `error` (string, required) - `code` (string, optional) — Stable error code. `insufficient_scope` marks an API key that lacks a scope this request needs. - `details` (list of ErrorDetailsItems, optional) - `requiredScopes` (list of string, optional) — On `insufficient_scope`: every API key scope this request needs. ## Types ### V1ClientTokensPostResponsesContentApplicationJsonSchemaClientToken - `agentIds` (list of string, required) - `allowedOrigins` (list of string, required) - `config` (map from string to any, required) - `createdAt` (string, required) - `defaultFlowId` (string, required, nullable) - `environment` (enum, required) - Allowed values: `test`, `live` - `flowIds` (list of string, required) - `id` (string, required) - `isActive` (boolean, required) - `lastUsedAt` (string, required, nullable) - `maxMessagesPerSession` (integer, required, nullable) - `name` (string, required, nullable) - `pinToVersion` (string, required, nullable) - `rateLimitPerHour` (integer, required, nullable) - `rateLimitPerMinute` (integer, required, nullable) - `sessionIdleTimeoutMinutes` (integer, required, nullable) - `targetAlias` (string, required, nullable) — Release alias this token follows, re-resolved on every admission. Null when the token follows no pointer. - `targetVersionId` (string, required, nullable) — Exact agent version this token runs. Null when the token pins no version. - `tokenHint` (string, required, nullable) - `tokenPrefix` (string, required) - `tokenValue` (string, required, nullable) - `updatedAt` (string, required) - `conversationCount` (integer, optional) - `productSurfaceId` (string, optional, nullable) ### V1ClientTokensPostResponsesContentApplicationJsonSchemaWarningsItems - `message` (string, required) - `type` (string, required) ### ErrorDetailsItems - `message` (string, required) - `code` (string, optional) — Stable Runtype validation code (e.g. MISSING_REQUIRED_FIELD, INVALID_ENUM). - `path` (string, optional) — Dotted JSON path to the offending field. - `suggestion` (string, optional) — Actionable hint (allowed values, accepted range, …). ## Examples **Request** ```json { "allowedOrigins": [ "https://example.com", "http://localhost:3000" ], "name": "My Chat Widget", "config": { "placeholder": "Type your message...", "theme": { "mode": "light", "primaryColor": "#007bff" }, "welcomeMessage": "Hello! How can I help you today?" }, "defaultFlowId": "flow_01jv0000000000000000000001", "environment": "live", "flowIds": [ "flow_01jv0000000000000000000001" ], "maxMessagesPerSession": 100, "rateLimitPerHour": 100, "rateLimitPerMinute": 10, "sessionIdleTimeoutMinutes": 30 } ``` **Response** ```json { "clientToken": { "agentIds": [ "string" ], "allowedOrigins": [ "string" ], "config": {}, "createdAt": "string", "defaultFlowId": "string", "environment": "test", "flowIds": [ "string" ], "id": "string", "isActive": true, "lastUsedAt": "string", "maxMessagesPerSession": 1, "name": "string", "pinToVersion": "string", "rateLimitPerHour": 1, "rateLimitPerMinute": 1, "sessionIdleTimeoutMinutes": 1, "targetAlias": "string", "targetVersionId": "string", "tokenHint": "string", "tokenPrefix": "string", "tokenValue": "string", "updatedAt": "string", "conversationCount": 1, "productSurfaceId": "string" }, "token": "string", "warnings": [ { "message": "string", "type": "string" } ] } ``` **SDK Code** ```python Create Client Token import requests url = "https://api.runtype.com/v1/client-tokens" payload = { "allowedOrigins": ["https://example.com", "http://localhost:3000"], "name": "My Chat Widget", "config": { "placeholder": "Type your message...", "theme": { "mode": "light", "primaryColor": "#007bff" }, "welcomeMessage": "Hello! How can I help you today?" }, "defaultFlowId": "flow_01jv0000000000000000000001", "environment": "live", "flowIds": ["flow_01jv0000000000000000000001"], "maxMessagesPerSession": 100, "rateLimitPerHour": 100, "rateLimitPerMinute": 10, "sessionIdleTimeoutMinutes": 30 } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Create Client Token const url = 'https://api.runtype.com/v1/client-tokens'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"allowedOrigins":["https://example.com","http://localhost:3000"],"name":"My Chat Widget","config":{"placeholder":"Type your message...","theme":{"mode":"light","primaryColor":"#007bff"},"welcomeMessage":"Hello! How can I help you today?"},"defaultFlowId":"flow_01jv0000000000000000000001","environment":"live","flowIds":["flow_01jv0000000000000000000001"],"maxMessagesPerSession":100,"rateLimitPerHour":100,"rateLimitPerMinute":10,"sessionIdleTimeoutMinutes":30}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Create Client Token package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.runtype.com/v1/client-tokens" payload := strings.NewReader("{\n \"allowedOrigins\": [\n \"https://example.com\",\n \"http://localhost:3000\"\n ],\n \"name\": \"My Chat Widget\",\n \"config\": {\n \"placeholder\": \"Type your message...\",\n \"theme\": {\n \"mode\": \"light\",\n \"primaryColor\": \"#007bff\"\n },\n \"welcomeMessage\": \"Hello! How can I help you today?\"\n },\n \"defaultFlowId\": \"flow_01jv0000000000000000000001\",\n \"environment\": \"live\",\n \"flowIds\": [\n \"flow_01jv0000000000000000000001\"\n ],\n \"maxMessagesPerSession\": 100,\n \"rateLimitPerHour\": 100,\n \"rateLimitPerMinute\": 10,\n \"sessionIdleTimeoutMinutes\": 30\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Create Client Token require 'uri' require 'net/http' url = URI("https://api.runtype.com/v1/client-tokens") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"allowedOrigins\": [\n \"https://example.com\",\n \"http://localhost:3000\"\n ],\n \"name\": \"My Chat Widget\",\n \"config\": {\n \"placeholder\": \"Type your message...\",\n \"theme\": {\n \"mode\": \"light\",\n \"primaryColor\": \"#007bff\"\n },\n \"welcomeMessage\": \"Hello! How can I help you today?\"\n },\n \"defaultFlowId\": \"flow_01jv0000000000000000000001\",\n \"environment\": \"live\",\n \"flowIds\": [\n \"flow_01jv0000000000000000000001\"\n ],\n \"maxMessagesPerSession\": 100,\n \"rateLimitPerHour\": 100,\n \"rateLimitPerMinute\": 10,\n \"sessionIdleTimeoutMinutes\": 30\n}" response = http.request(request) puts response.read_body ``` ```java Create Client Token import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://api.runtype.com/v1/client-tokens") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"allowedOrigins\": [\n \"https://example.com\",\n \"http://localhost:3000\"\n ],\n \"name\": \"My Chat Widget\",\n \"config\": {\n \"placeholder\": \"Type your message...\",\n \"theme\": {\n \"mode\": \"light\",\n \"primaryColor\": \"#007bff\"\n },\n \"welcomeMessage\": \"Hello! How can I help you today?\"\n },\n \"defaultFlowId\": \"flow_01jv0000000000000000000001\",\n \"environment\": \"live\",\n \"flowIds\": [\n \"flow_01jv0000000000000000000001\"\n ],\n \"maxMessagesPerSession\": 100,\n \"rateLimitPerHour\": 100,\n \"rateLimitPerMinute\": 10,\n \"sessionIdleTimeoutMinutes\": 30\n}") .asString(); ``` ```php Create Client Token request('POST', 'https://api.runtype.com/v1/client-tokens', [ 'body' => '{ "allowedOrigins": [ "https://example.com", "http://localhost:3000" ], "name": "My Chat Widget", "config": { "placeholder": "Type your message...", "theme": { "mode": "light", "primaryColor": "#007bff" }, "welcomeMessage": "Hello! How can I help you today?" }, "defaultFlowId": "flow_01jv0000000000000000000001", "environment": "live", "flowIds": [ "flow_01jv0000000000000000000001" ], "maxMessagesPerSession": 100, "rateLimitPerHour": 100, "rateLimitPerMinute": 10, "sessionIdleTimeoutMinutes": 30 }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Create Client Token using RestSharp; var client = new RestClient("https://api.runtype.com/v1/client-tokens"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"allowedOrigins\": [\n \"https://example.com\",\n \"http://localhost:3000\"\n ],\n \"name\": \"My Chat Widget\",\n \"config\": {\n \"placeholder\": \"Type your message...\",\n \"theme\": {\n \"mode\": \"light\",\n \"primaryColor\": \"#007bff\"\n },\n \"welcomeMessage\": \"Hello! How can I help you today?\"\n },\n \"defaultFlowId\": \"flow_01jv0000000000000000000001\",\n \"environment\": \"live\",\n \"flowIds\": [\n \"flow_01jv0000000000000000000001\"\n ],\n \"maxMessagesPerSession\": 100,\n \"rateLimitPerHour\": 100,\n \"rateLimitPerMinute\": 10,\n \"sessionIdleTimeoutMinutes\": 30\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Create Client Token import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "allowedOrigins": ["https://example.com", "http://localhost:3000"], "name": "My Chat Widget", "config": [ "placeholder": "Type your message...", "theme": [ "mode": "light", "primaryColor": "#007bff" ], "welcomeMessage": "Hello! How can I help you today?" ], "defaultFlowId": "flow_01jv0000000000000000000001", "environment": "live", "flowIds": ["flow_01jv0000000000000000000001"], "maxMessagesPerSession": 100, "rateLimitPerHour": 100, "rateLimitPerMinute": 10, "sessionIdleTimeoutMinutes": 30 ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.runtype.com/v1/client-tokens")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```