# Make a connect token for a page

> Page: https://docs.flung.dev/reference/api/post-v1-connect-tokens. Index of every page: https://docs.flung.dev/llms.txt

Lets a page in a browser show "connect your accounts" without holding your API key: make the token on your server, hand it to the page, and the page (with `<flung-connect>` from `@flung.dev/connect`, or its own calls) can list, connect, reconnect and disconnect accounts until it expires, from the listed origins only.

`POST /v1/connect-tokens`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Make a connect token for a page. |
| What does it need? | An API key or an OAuth access token. |
| What does it take? | A JSON body with the fields below. |
| What does it return? | Status 201 with a body of type [`ConnectToken`](https://docs.flung.dev/reference/api/schemas.md#connecttoken). |
| In the SDK? | `flung.connectTokens.create()` |
| What can go wrong? | `401` Missing, unknown, revoked or expired API key; `422` The request failed validation; `429` Too many requests for this credential; wait for `retry-after` seconds. Every failure has the same [error shape](https://docs.flung.dev/reference/api/errors.md). |

## What it does

Lets a page in a browser show "connect your accounts" without holding your API key: make the token on your server, hand it to the page, and the page (with `<flung-connect>` from `@flung.dev/connect`, or its own calls) can list, connect, reconnect and disconnect accounts until it expires, from the listed origins only. Needs a full-access credential.

## Example

**curl**

```bash
curl -X POST 'https://api.flung.dev/v1/connect-tokens' \
  --header "Authorization: Bearer $FLUNG_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $(uuidgen)" \
  --data '{
  "origins": [
    "https://app.example.com"
  ],
  "platforms": [
    "x",
    "linkedin",
    "bluesky"
  ]
}'
```

**TypeScript**

```ts
import { Flung } from '@flung.dev/sdk'

const flung = new Flung({ apiKey: process.env.FLUNG_API_KEY! })
const result = await flung.connectTokens.create({
  origins: [
    'https://app.example.com',
  ],
  platforms: [
    'x',
    'linkedin',
    'bluesky',
  ],
})
```

**fetch**

```js
const response = await fetch('https://api.flung.dev/v1/connect-tokens', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.FLUNG_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    origins: [
      'https://app.example.com',
    ],
    platforms: [
      'x',
      'linkedin',
      'bluesky',
    ],
  }),
})
if (!response.ok) throw new Error((await response.json()).error.message)
const result = await response.json()
```

A successful answer looks like this:

```json
{
  "token": "flung_ct_eyJ3Ijoid3NfMSJ9.c2ln",
  "expiresAt": "2026-11-01T09:00:00.000Z",
  "origins": [
    "string"
  ],
  "profileId": "string",
  "platforms": [
    "x"
  ]
}
```

## Request body

The body has the type an object, with the fields below.

| Field | Type | Required | Description |
|---|---|---|---|
| `origins` | `string[]` | yes | The pages that will use the token, as origins. https only, except `http://localhost` and `http://127.0.0.1` for trying it out. |
| `profileId` | `string` | no | Accounts connected with the token join this profile, and the token sees only that profile's accounts. Omit it for the whole workspace. |
| `platforms` | `Platform[]` | no | The platforms the token may connect. Omit it for every platform. |
| `expiresIn` | `integer` | no | Seconds until the token stops working. Default one hour, at most one day. minimum 60; maximum 86400; default 3600. |

## Responses

| Status | Meaning | Body |
|---|---|---|
| 201 | The token. | [`ConnectToken`](https://docs.flung.dev/reference/api/schemas.md#connecttoken) |
| 401 | Missing, unknown, revoked or expired API key. | [`Error`](https://docs.flung.dev/reference/api/schemas.md#error) |
| 422 | The request failed validation. | [`Error`](https://docs.flung.dev/reference/api/schemas.md#error) |
| 429 | Too many requests for this credential; wait for `retry-after` seconds. | [`Error`](https://docs.flung.dev/reference/api/schemas.md#error) |

## Response body

A 201 answer has the type [`ConnectToken`](https://docs.flung.dev/reference/api/schemas.md#connecttoken).

| Field | Type | Required | Description |
|---|---|---|---|
| `token` | `string` | yes | Hand this to the page (`<flung-connect token>`). It can only list, connect, reconnect and disconnect accounts. |
| `expiresAt` | `string` | yes |  |
| `origins` | `string[]` | yes |  |
| `profileId` | `string \| null` | yes |  |
| `platforms` | `array \| null` | yes |  |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.flung.dev/reference/api.md) | Every endpoint |
| [Schemas](https://docs.flung.dev/reference/api/schemas.md) | Every request and response type |
| [Errors](https://docs.flung.dev/reference/api/errors.md) | Every error code and what to do about it |