Mint a cookie-free token for the published app

POST

/api/workspaces/{workspaceId}/apps/{id}/view-token

const url = 'http://localhost:8080/api/workspaces/example/apps/example/view-token';
const options = {method: 'POST', headers: {cookie: 'auth_session=<auth_session>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:8080/api/workspaces/example/apps/example/view-token \
  --cookie auth_session=<auth_session>

Viewing a published app happens in a sandboxed, opaque-origin iframe, and ES modules are always fetched in CORS mode WITHOUT credentials — so a cookie-authorized URL 401s there however well it works in a normal tab, and the app renders nothing. This returns the same kind of short-lived token the build preview uses, authorized here by the caller’s workspace access. It starts no sandbox: the bytes come from the deployment store.

Authorizations

cookieAuth
bearerAuth

Parameters

Path Parameters

workspaceId

required

string

required

string

Responses

2XX

Successful response

application/json

object

success

Whether the request succeeded.

boolean

data

Endpoint-specific response payload.

message

string

error

string

Example

{
  "message": "Operation completed",
  "error": "Error message"
}

4XX

Invalid request

application/json

object

success

boolean

error

string

Example

{
  "error": "Error message"
}

5XX

Internal server error

application/json

object

success

boolean

error

string

Example

{
  "error": "Error message"
}