Create Auth Token
Mint an agent auth token. The agent reads this value from the API_TOKEN environment variable and presents it during handshake with the tunnel-server. The full token is returned only once — store it on the agent's host immediately.
Account scope: the token belongs to your active account and may carry traffic for that account's endpoints per your role's permissions. Use switch account to mint a token in a different account.
Bind the token to a specific endpoint (or tunnel) for least-privilege: a per-tunnel token can only carry traffic for that tunnel, so a leak from one machine doesn't expose your other endpoints. Unbound tokens (no endpoint_uuid) are convenient for development and one-shot tunnels but are powerful — keep them ephemeral.
The Python SDK calls this endpoint internally on every ngris.connect(), mints a new token, runs the agent with it, and revokes the token via DELETE /v1/keys/auth/{uuid} on shutdown.
Request body
"ngris-python sdk (http localhost:8080)" so administrators can see "where did this token come from".uuid of the endpoint this token may carry traffic for, in your active account. Without this the token is "unbound" and works for any endpoint of the account.uuid from /tunnels). Mostly used internally by the platform.Deprecated: endpoint_id and tunnel_id (integers) are still accepted until the sunset. Send endpoint_uuid / tunnel_uuid; sending both forms for different objects is a 400 id_uuid_mismatch.
Response (200 OK)
nga_ + 40 characters (letters, digits, _ and -). Set on the agent's host as the API_TOKEN environment variable.Deprecated: until the sunset this response also carries the legacy integer id field. Don't use it; read uuid.
Errors
endpoint_uuid / tunnel_uuid is not a uuid; id_uuid_mismatch; an integer id after the sunset (integer_id_unsupported).endpoint_uuid not found / tunnel_uuid not found). Another account's id is refused, never bound.