Create an embed sign-in token

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/embed-url \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "jsmith@example.com",
  "target": "live_site"
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/embed-url"

payload = {
    "email": "jsmith@example.com",
    "target": "live_site"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'jsmith@example.com', target: 'live_site'})
};

fetch('https://app.base44.com/api/apps/{app_id}/embed-url', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/embed-url",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => 'jsmith@example.com',
    'target' => 'live_site'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/embed-url"

	payload := strings.NewReader("{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/embed-url")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/embed-url")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}"

response = http.request(request)
puts response.read_body

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig",
  "expires_in": 60,
  "embed_url": "https://weekly-report.base44.app/?ott=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Embed Tokens

Create an embed sign-in token

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Creates a single-use sign-in token for a provisioned app user and returns embed_url, the chosen surface’s address with the token on it. Load it in an iframe and the app opens signed in as that user. The app’s owner can be signed in without being provisioned, by a workspace API key or by the owner’s own token. live_preview starts the app’s sandbox if it isn’t running; until it is, the URL shows a loading page. Call it with a personal access token whose owner can edit the app, or with a workspace API key that has the Mint embed sign-in tokens permission. Limited to 300 requests a minute per app. Higher plans get a higher limit.

POST

api

apps

{app_id}

embed-url

Create an embed sign-in token

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/embed-url \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "jsmith@example.com",
  "target": "live_site"
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/embed-url"

payload = {
    "email": "jsmith@example.com",
    "target": "live_site"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'jsmith@example.com', target: 'live_site'})
};

fetch('https://app.base44.com/api/apps/{app_id}/embed-url', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/embed-url",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => 'jsmith@example.com',
    'target' => 'live_site'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/embed-url"

	payload := strings.NewReader("{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/embed-url")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/embed-url")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"jsmith@example.com\",\n  \"target\": \"live_site\"\n}"

response = http.request(request)
puts response.read_body

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig",
  "expires_in": 60,
  "embed_url": "https://weekly-report.base44.app/?ott=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

required

Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.

Path Parameters

app_id

string

required

ID of the app.

Body

application/json

The app user to mint for, and which of the app's surfaces to frame.

string<email>

required

The app user's email

target

enum<string>

default:live_site

Which of the app's surfaces to frame: live_site (the default, the published app), latest_preview (main's static build) or live_preview (the running sandbox).

Available options:

live_site,

latest_preview,

live_preview

Response

Successful Response

A single-use sign-in token, and the URL that spends it.

token

string

required

The single-use sign-in token. Already on embed_url; you don't need to send it anywhere yourself.

Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig"

expires_in

integer

required

Seconds until the token expires.

Example:

60

embed_url

string

required

The chosen surface's address with the token on it. Load it in an iframe.

Example:

"https://weekly-report.base44.app/?ott=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sig"

Base44 APIs

Apps API (Beta)

Workspace API (Beta)

Superagents API (Beta)

Monitoring API

Audit Logs API

Outbound webhooks

Create an embed sign-in token

Authorizations

Path Parameters

Body

Response