Skip to main content
POST
Issue or revoke a portal access token

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Path Parameters

project_id
string
required
portal_id
string
required

Body

application/json

One endpoint, two modes, discriminated by the presence of a string revoke.

customer_id
string
required

The tenant's own identifier for their end customer. Trimmed; must be non-empty.

Minimum string length: 1
scopes
string[]

Stored on the token but not enforced by the portal API today.

expires_in_days
number

Must be finite and > 0 to take effect; anything else means the token never expires.

Response

Revoke mode only — the token was revoked.

ok
enum<boolean>
required
Available options:
true