Update client token

PUT

/v1/client-tokens/:id

PUT

/v1/client-tokens/:id

$ curl -X PUT https://api.runtype.com/v1/client-tokens/id \
>      -H "Authorization: <apiKey>" \
>      -H "Content-Type: application/json" \
>      -d '{
>   "allowedOrigins": [
>     "https://example.com",
>     "https://app.example.com"
>   ],
>   "config": {
>     "theme": {
>       "mode": "dark",
>       "primaryColor": "#28a745"
>     },
>     "welcomeMessage": "Welcome! How can I assist you?"
>   },
>   "isActive": true,
>   "name": "Updated Widget Name",
>   "rateLimitPerMinute": 20
> }'

1 {
2   "clientToken": {
3     "agentIds": [
4       "string"
5     ],
6     "allowedOrigins": [
7       "string"
8     ],
9     "config": {},
10     "createdAt": "string",
11     "defaultFlowId": "string",
12     "environment": "test",
13     "flowIds": [
14       "string"
15     ],
16     "id": "string",
17     "isActive": true,
18     "lastUsedAt": "string",
19     "maxMessagesPerSession": 1,
20     "name": "string",
21     "pinToVersion": "string",
22     "rateLimitPerHour": 1,
23     "rateLimitPerMinute": 1,
24     "sessionIdleTimeoutMinutes": 1,
25     "targetAlias": "string",
26     "targetVersionId": "string",
27     "tokenHint": "string",
28     "tokenPrefix": "string",
29     "tokenValue": "string",
30     "updatedAt": "string",
31     "conversationCount": 1,
32     "productSurfaceId": "string"
33   },
34   "warnings": [
35     {
36       "message": "string",
37       "type": "string"
38     }
39   ]
40 }

Update fields on an existing client token.

Authentication

AuthorizationBearer

API key or Clerk session token

Path parameters

idstringRequired

Request

This endpoint expects an object.

agentIdslist of stringsOptional

allowedOriginslist of stringsOptional

Allowed request origins for this token. Each entry is an exact origin (https://app.example.com), a wildcard subdomain (https://.example.com), '' for all origins, or the literal ‘native’ — a sentinel that admits requests carrying NO Origin header (native mobile apps). A token with ‘native’ has effectively no origin protection and relies on its capability scope.

Allowed request origins for this token. Each entry is an exact origin (https://app.example.com), a wildcard subdomain (https://*.example.com), '*' for all origins, or the literal 'native' — a sentinel that admits requests carrying NO Origin header (native mobile apps). A token with 'native' has effectively no origin protection and relies on its capability scope.

configmap from strings to anyOptional

defaultFlowIdstringOptional

flowIdslist of stringsOptional

isActivebooleanOptional

maxMessagesPerSessiondoubleOptional1-1000

namestringOptional1-255 characters

pinToVersionstringOptional

Legacy widget-version mode: ‘latest’ or ‘published’. A NEW agent version id (agentver_…) is rejected; echoing back the value already stored is accepted and ignored, so a read-modify-write client can save unrelated fields. Use targetVersionId to pin a version.

rateLimitPerHourdoubleOptional1-10000

rateLimitPerMinutedoubleOptional1-1000

sessionIdleTimeoutMinutesdoubleOptional1-1440

targetAliasstring or nullOptional

targetVersionIdstring or nullOptional

Response

Updated client token

clientTokenobject

warningslist of objects

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

500

Internal Server Error