Make a connect token for a page
Lets a page in a browser show "connect your accounts" without holding your API key: make the token on your server, hand it to the page, and the page (with <flung-connect> from @flung.dev/connect, or its own calls) can list, connect, reconnect and disconnect accounts until it expires, from the listed origins only.
/v1/connect-tokensTL;DR
| Question | Answer |
|---|---|
| What does it do? | Make a connect token for a page. |
| What does it need? | An API key or an OAuth access token. |
| What does it take? | A JSON body with the fields below. |
| What does it return? | Status 201 with a body of type ConnectToken. |
| In the SDK? | flung.connectTokens.create() |
| What can go wrong? | 401 Missing, unknown, revoked or expired API key; 422 The request failed validation; 429 Too many requests for this credential; wait for retry-after seconds. Every failure has the same error shape. |
What it does
Lets a page in a browser show "connect your accounts" without holding your API key: make the token on your server, hand it to the page, and the page (with <flung-connect> from @flung.dev/connect, or its own calls) can list, connect, reconnect and disconnect accounts until it expires, from the listed origins only. Needs a full-access credential.
Example
curl -X POST 'https://api.flung.dev/v1/connect-tokens' \ --header "Authorization: Bearer $FLUNG_API_KEY" \ --header 'Content-Type: application/json' \ --header "Idempotency-Key: $(uuidgen)" \ --data '{ "origins": [ "https://app.example.com" ], "platforms": [ "x", "linkedin", "bluesky" ]}'import { Flung } from '@flung.dev/sdk'
const flung = new Flung({ apiKey: process.env.FLUNG_API_KEY! })const result = await flung.connectTokens.create({ origins: [ 'https://app.example.com', ], platforms: [ 'x', 'linkedin', 'bluesky', ],})const response = await fetch('https://api.flung.dev/v1/connect-tokens', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.FLUNG_API_KEY}`, 'Content-Type': 'application/json', 'Idempotency-Key': crypto.randomUUID(), }, body: JSON.stringify({ origins: [ 'https://app.example.com', ], platforms: [ 'x', 'linkedin', 'bluesky', ], }),})if (!response.ok) throw new Error((await response.json()).error.message)const result = await response.json()A successful answer looks like this:
{ "token": "flung_ct_eyJ3Ijoid3NfMSJ9.c2ln", "expiresAt": "2026-11-01T09:00:00.000Z", "origins": [ "string" ], "profileId": "string", "platforms": [ "x" ]}Request body
The body has the type an object, with the fields below.
| Field | Type | Required | Description |
|---|---|---|---|
origins | string[] | yes | The pages that will use the token, as origins. https only, except http://localhost and http://127.0.0.1 for trying it out. |
profileId | string | no | Accounts connected with the token join this profile, and the token sees only that profile's accounts. Omit it for the whole workspace. |
platforms | Platform[] | no | The platforms the token may connect. Omit it for every platform. |
expiresIn | integer | no | Seconds until the token stops working. Default one hour, at most one day. minimum 60; maximum 86400; default 3600. |
Responses
| Status | Meaning | Body |
|---|---|---|
| 201 | The token. | ConnectToken |
| 401 | Missing, unknown, revoked or expired API key. | Error |
| 422 | The request failed validation. | Error |
| 429 | Too many requests for this credential; wait for retry-after seconds. | Error |
Response body
A 201 answer has the type ConnectToken.
| Field | Type | Required | Description |
|---|---|---|---|
token | string | yes | Hand this to the page (<flung-connect token>). It can only list, connect, reconnect and disconnect accounts. |
expiresAt | string | yes | |
origins | string[] | yes | |
profileId | string | null | yes | |
platforms | array | null | yes |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint |
| Schemas | Every request and response type |
| Errors | Every error code and what to do about it |