> ## Documentation Index > Fetch the complete documentation index at: https://veryfront.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create Environment Access Token > Exchanges an API key for a five-minute token that opens one protected environment. An all-project key acts as its owner; a project-scoped key acts as a token principal for its own project only. The token is bound to the named project and environment, is not accepted by this API, and is not recalled when the key is revoked; it expires on its own. ## OpenAPI ````yaml https://api.veryfront.com/openapi.json post /auth/environment-token openapi: 3.1.0 info: title: Veryfront REST API version: 1.0.0 summary: Domain-first REST reference for the maintained Veryfront HTTP API surface. description: >- Project-first HTTP API for Veryfront project resources. Root account/platform endpoints that still appear in this reference are transitional compatibility surfaces unless the canonical inventory marks them otherwise. ## Start here - **Interactive REST reference:** [/docs](/docs) - **Raw OpenAPI document:** [/openapi.json](/openapi.json) - **Canonical inventory:** `docs/api-surface-inventory.md` in this repository - **GraphQL endpoint:** [/graphql](/graphql) - **MCP playground:** [/mcp/playground](/mcp/playground) ## Authentication Use one of these request headers: - `Authorization: Bearer ` - `Authorization: Bearer vf__` - `X-API-Key: vf__` JWTs must use the Bearer token contract. API keys work in either the Bearer header or `X-API-Key`. ## Discovery model Veryfront is one platform with multiple access modes: - **REST** for resource-oriented and operational HTTP workflows - **GraphQL** for connected app-facing data and typed mutations - **MCP** for tool-style automation and agent workflows For the fastest path through the platform, start with the project-scoped domain groups. Transitional account/platform groups are retained for compatibility and follow the removal register in the canonical inventory. contact: name: Veryfront API Support url: https://veryfront.com/docs email: support@veryfront.com servers: - url: https://api.veryfront.com description: Current request origin - url: http://localhost:4000 description: Local development security: - bearerAuth: [] - apiKeyAuth: [] tags: - name: Projects description: Core project operations - name: Account description: >- Transitional account-level users and settings retained for dashboard compatibility - name: Project Users description: Project members and invites - name: Members description: Project members and invites - name: Files description: Main branch files - name: Branch Files description: Files on branches - name: Environment Files description: Files in environments - name: Release Files description: Files in releases - name: Uploads description: File uploads and assets - name: Branches description: Content branches for previews - name: Releases description: Published file snapshots - name: Deployments description: Connect releases to environments - name: Environments description: Deployment targets and variables - name: Environment Variables description: Project environment variable management - name: Domains description: Custom domains for environments - name: Project Servers description: Project-scoped dedicated server instances - name: Root Servers description: >- Transitional root dedicated-server administration retained for compatibility - name: Tasks description: Project tasks - name: Evals description: Project eval definitions and eval run projections - name: Workflows description: Project workflows - name: Workflow Runs description: Workflow run history and status - name: Schedules description: Recurring project automation schedules - name: Webhooks description: Webhook-triggered automation entry points - name: Skills description: Project skills - name: Prompts description: Project prompts - name: Tools description: Project tools - name: Resources description: Project-defined resource documents and source-backed resource definitions - name: Sandboxes description: Ephemeral sandbox execution environments - name: Search description: Text and vector search - name: Knowledge description: Knowledge manifest lookup across project knowledge files - name: Chunks description: File chunks for search indexing - name: Embeddings description: Vector embeddings - name: RAG Documents description: Project retrieval-augmented knowledge documents - name: Style Artifacts description: Project style artifact state and build outputs - name: Dependencies description: >- npm dependency resolution, exact-version pinning, and signed runtime artifact registry contracts - name: External Storage description: Transitional connected cloud-provider file operations - name: Project Cache description: Project-scoped distributed cache operations - name: User Cache description: Transitional user cache helpers retained for compatibility - name: API Keys description: >- Transitional user/account API key management; prefer project-scoped keys for public integrations - name: User description: Transitional current-user profile endpoint for first-party clients - name: Favorites description: Transitional user favorites for first-party dashboard clients - name: Subscriptions description: Transitional account billing and subscription workflows - name: Credits description: Transitional account credit balance, purchase, and insufficiency flows - name: Usage description: >- Project/account usage limits and warnings; account-level usage is transitional - name: Gates description: Transitional plan and feature gate checks for first-party clients - name: Channels description: Project channel integrations and delivery settings - name: Agents description: Project agents - name: Agent Templates description: >- Public template catalog of addable agents assembled from curated template projects - name: Agent Workers description: Internal/transitional agent worker leases and sessions - name: Agent Runtimes description: Registered push-based agent runtime services and runtime target health - name: Project Integrations description: Project-scoped integration catalog and configuration - name: Integrations description: Transitional external integration catalog for first-party clients - name: Connections description: Viewer-visible project and project-user integration connections - name: Integration Tools description: >- Transitional dynamic integration tool listing, invocation, and connection state - name: OAuth description: >- Transitional OAuth integration flows for first-party and connected-app clients - name: Templates description: Transitional starter-template discovery used during project creation - name: AI description: >- Transitional platform AI gateway/model helpers; project AI assets use project-scoped routes - name: Images description: Generated images and image assets - name: Conversations description: Transitional conversation/run-control HTTP surface for first-party clients - name: Runs description: Transitional hosted run-control endpoints for conversation execution - name: MCP description: >- MCP catalog/playground helpers; primary MCP traffic uses the streamable MCP handler - name: Logs description: Project log queries via Loki - name: Metrics description: Project metric queries via a Prometheus-compatible backend - name: Traces description: Project trace queries via Grafana Tempo - name: Errors description: Internal/public error type catalog (RFC 9457) - name: Authentication description: Transitional auth token, login, logout, magic-link, and JWKS flows externalDocs: description: Interactive REST reference url: https://api.veryfront.com/docs paths: /auth/environment-token: post: tags: - Authentication summary: Create Environment Access Token description: >- Exchanges an API key for a five-minute token that opens one protected environment. An all-project key acts as its owner; a project-scoped key acts as a token principal for its own project only. The token is bound to the named project and environment, is not accepted by this API, and is not recalled when the key is revoked; it expires on its own. operationId: createEnvironmentToken requestBody: content: application/json: schema: $ref: '#/components/schemas/EnvironmentAccessTokenRequest' responses: '200': description: Environment access token issued content: application/json: schema: $ref: '#/components/schemas/EnvironmentAccessTokenResponse' '401': description: A valid API key is required content: application/json: schema: $ref: '#/components/schemas/AuthErrorResponse' '403': description: The key has no access to the target project content: application/json: schema: $ref: '#/components/schemas/AuthErrorResponse' '404': description: The project or environment does not exist content: application/json: schema: $ref: '#/components/schemas/AuthErrorResponse' security: - bearerAuth: [] - apiKeyAuth: [] components: schemas: EnvironmentAccessTokenRequest: type: object properties: project_reference: type: string minLength: 1 maxLength: 200 description: Project UUID or slug that owns the environment environment_name: type: string minLength: 1 maxLength: 200 description: Environment the token opens required: - project_reference - environment_name EnvironmentAccessTokenResponse: type: object properties: access_token: type: string description: >- Short-lived environment access token for protected environment requests token_type: type: string enum: - Bearer description: Token type expires_in: type: integer minimum: 0 exclusiveMinimum: true description: Seconds until the token expires required: - access_token - token_type - expires_in AuthErrorResponse: type: object properties: error: type: string description: Error type message: type: string description: Detailed error message required: - error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT or API Key description: >- Use a JWT bearer token or a Veryfront API key in the Authorization header. apiKeyAuth: type: apiKey in: header name: X-API-Key description: Alternative API key header for vf__ tokens. ````