Mint self-serve sandbox credentials: a personal key, an OAuth client and a webhook signing key for a new tenant
The sandbox issues its own credentials: no account, no form. One call creates a tenant with a personal API key, an OAuth client (id and secret for POST /oauth/token) and a webhook signing key, all carrying every scope and all expiring together (see expires_at). The secrets are shown once. Rate-limited per caller address; a 429 carries Retry-After. Sandbox only: destinations are mock tenants, and the production service will not expose this route.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Optional. A label helps you tell credential sets apart.
Free text, stored with the tenant.
80Response
Created
A new sandbox tenant and every credential it needs. Shown once: the server keeps only hashes.
Tenant id (tn_...). Intents are visible only to this tenant's credentials.
Personal sandbox key (sk_sandbox_...), every scope. Send as Authorization: Bearer <api_key>.
OAuth 2.0 client id for POST /oauth/token.
Signing key for POST /webhooks/{platform} deliveries that reference this tenant's intents (X-Signature-HMAC-SHA256-{n}).
Space-separated scopes the credentials carry (all of them).
When every credential in this set stops working; mint again after.
"/v1/oauth/token"