Mint a token for an installation

POST 
/installations/:external_id/tokens

Mints another company-owned token for an active install — for example one a founder made through the install link. Scopes default to the install's grant and can only narrow it. The token appears in this response only. Requires a token authorized by a user who installed it, could revoke it, or manages the app's organization.

Request

Responses

201

The installation and a new token (shown once)

401

Authentication required or token is invalid/expired. This error occurs when:

• No Authorization header is provided
• The access token is invalid or malformed
• The access token has expired
• The access token has been revoked

To resolve: Obtain a new access token using the OAuth 2.0 flow.

403

The authenticated user does not have permission to access this resource. This typically means:

• The user is authenticated but lacks the required OAuth scope
• The resource belongs to a different user
• The user's role doesn't allow this operation

Check that your OAuth token includes the necessary scopes for this endpoint.

404

The requested resource does not exist or is not visible to this token.

409

The installation has been revoked.