> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint an agent gateway token for a Devbox.

> Mint a token that lets a running Devbox call an external API through the Runloop agent gateway, using the credential in the supplied secret. The gateway applies the credential to proxied requests, so the real API key is never exposed to the Devbox.

The token is bound to this Devbox and is only accepted for requests that originate from it. Nothing is stored on the Devbox: the token is returned to the caller and is not re-issued when the Devbox is resumed.



## OpenAPI

````yaml /openapi-specs/stainless-processed-openapi.json post /v1/devboxes/{id}/create_gateway_token
openapi: 3.1.0
info:
  title: RunLoop API
  version: '0.1'
  description: >-
    The RunLoop API spec that allows you to host lambda functions and Devboxes
    to enable scaled long running ai workflows.
  contact:
    name: Runloop AI Support
    url: https://runloop.ai
    email: support@runloop.ai
servers:
  - url: https://api.runloop.ai
    description: Runloop API
    variables: {}
security:
  - bearerAuth: []
tags:
  - name: Benchmark
  - name: Blueprint
  - name: Blueprint-Lifecycle
  - name: Blueprint-ObservabilityTools
  - name: Devbox
  - name: Devbox-FileTools
  - name: Devbox-Lifecycle
  - name: Devbox-NetworkTools
  - name: Devbox-ObservabilityTools
  - name: Devbox-PersistenceTools
  - name: Devbox-ShellTools
  - name: Scenario
  - name: ScenarioScorer
  - name: accounts
  - name: agents
  - name: apikeys
  - name: axons
  - name: executions
  - name: gateway-configs
  - name: mcp-configs
  - name: network-policies
  - name: objects
  - name: restricted_keys
  - name: secrets
  - name: streaming
paths:
  /v1/devboxes/{id}/create_gateway_token:
    post:
      tags:
        - Devbox
        - Devbox-NetworkTools
      summary: Mint an agent gateway token for a Devbox.
      description: >-
        Mint a token that lets a running Devbox call an external API through the
        Runloop agent gateway, using the credential in the supplied secret. The
        gateway applies the credential to proxied requests, so the real API key
        is never exposed to the Devbox.


        The token is bound to this Devbox and is only accepted for requests that
        originate from it. Nothing is stored on the Devbox: the token is
        returned to the caller and is not re-issued when the Devbox is resumed.
      operationId: createDevboxGatewayToken
      parameters:
        - name: id
          in: path
          description: The Devbox ID.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GatewayTokenCreateParameters'
      responses:
        '200':
          description: Gateway token minted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewayTokenView'
        '400':
          description: >-
            Devbox is not currently running, or the gateway config or secret was
            not found.
        '404':
          description: Devbox not found.
      x-codeSamples:
        - lang: JavaScript
          source: >-
            import Runloop from '@runloop/api-client';


            const client = new Runloop({
              bearerToken: process.env['RUNLOOP_API_KEY'], // This is the default and can be omitted
            });


            const gatewayTokenView = await
            client.devboxes.createGatewayToken('id', {
              gateway: 'gateway',
              secret: 'secret',
            });


            console.log(gatewayTokenView.devbox_id);
        - lang: Python
          source: |-
            import os
            from runloop_api_client import Runloop

            client = Runloop(
                bearer_token=os.environ.get("RUNLOOP_API_KEY"),  # This is the default and can be omitted
            )
            gateway_token_view = client.devboxes.create_gateway_token(
                id="id",
                gateway="gateway",
                secret="secret",
            )
            print(gateway_token_view.devbox_id)
components:
  schemas:
    GatewayTokenCreateParameters:
      type: object
      description: >-
        Parameters for minting an agent gateway token for a Devbox. The token
        lets the Devbox call the API described by the gateway config using the
        supplied credential, without ever receiving the credential itself.
      properties:
        gateway:
          type: string
          description: >-
            The gateway config to use. Can be a gateway config ID (gwc_xxx) or
            name.
        secret:
          type: string
          description: The secret containing the credential. Can be a secret ID or name.
      required:
        - gateway
        - secret
    GatewayTokenView:
      type: object
      properties:
        devbox_id:
          type: string
          description: The Devbox the token is bound to.
        gateway_config_id:
          type: string
          description: The ID of the gateway config the token proxies through.
        token:
          type: string
          description: >-
            The token to send to the gateway as a Bearer token in the
            Authorization header. Only accepted for requests originating from
            the bound Devbox.
        url:
          type: string
          description: >-
            The gateway URL to send requests to. Matches the value of the
            {prefix}_URL environment variable inside the Devbox.
        endpoint:
          type: string
          description: The target API endpoint the gateway proxies to.
        auth_mechanism:
          $ref: '#/components/schemas/AuthMechanismView'
          description: How the gateway applies the credential to proxied requests.
      required:
        - devbox_id
        - gateway_config_id
        - token
        - url
        - endpoint
        - auth_mechanism
    AuthMechanismView:
      type: object
      description: >-
        Defines how the primary credential is applied to requests proxied to the
        upstream.
      properties:
        type:
          type: string
          description: >-
            The type of authentication mechanism: 'header', 'bearer', or
            'basic'. For 'basic', store the secret as plain 'user:pass'; the
            proxy base64-encodes it.
        key:
          description: >-
            The header name (e.g., 'x-api-key'). Required for 'header' type;
            invalid for other types.
          type:
            - string
            - 'null'
      required:
        - type
  securitySchemes:
    bearerAuth:
      scheme: bearer
      type: http

````