Create a management token for the CLI

POST https://api.keenauth.com/v1/environments/{environment_id}/management-tokens · called by keenauth login

Exchanges the CLI's sign-in for a 10 minute token of one environment. You do not call this endpoint yourself: keenauth login signs you in with your dashboard account (device authorization or, with --web, a loopback redirect with PKCE) and the CLI requests a token for each environment it works on. The token is bound to the CLI's key (DPoP) and carries only the permissions of your dashboard role in that environment.

Request

Headers:

Header Required Description
Authorization yes DPoP <access token>: the access token the CLI received when you signed in.
DPoP yes A DPoP proof for this request, signed with the key the access token is bound to; it carries the hash of the access token and the server nonce.
Content-Type yes application/json.

Body: an empty JSON object, {}. Any other member is refused with unknown_field. The request has no Idempotency-Key: every call issues a new token.

Response

201 Created with Cache-Control: no-store:

Field Description
access_token The management token. Send it as Authorization: DPoP <token> with a proof of the same key.
token_type Always DPoP.
expires_in Lifetime in seconds: 600.
expires_at End of the lifetime (RFC 3339, UTC).
environment_id The environment the token is for.
audience The cell the token is for (<region>/<cell>).
api_base Base URL of the regional API that accepts the token.
permissions The environment permissions of your dashboard role.

The CLI keeps the token in memory only. A role change takes effect within 10 minutes at most; when a role is removed, the open tokens of that user are revoked.

Errors

Status Code When
401 unauthenticated No access token was sent.
401 invalid_token The access token is invalid, expired or not the CLI's; sign in again with keenauth login.
401 invalid_dpop_proof The DPoP proof is missing, repeated or does not match the request or the token's key.
401 use_dpop_nonce Retry with a proof that carries the nonce of the DPoP-Nonce response header.
401 insufficient_user_authentication Multi-factor authentication (or, for your role, a passkey or security key) is required; sign in again.
404 not_found The environment does not exist or you have no dashboard role in it.
429 rate_limited More than 30 tokens per minute for your user (shared with the dashboard); wait for Retry-After.

Example

curl -X POST https://api.keenauth.com/v1/environments/env_01jb0000000000000000000000/management-tokens \
  -H "Authorization: DPoP $ACCESS_TOKEN" \
  -H "DPoP: $DPOP_PROOF" \
  -H "Content-Type: application/json" \
  -d '{}'