---
title: Mint a short-lived user-scoped token
description: Session-only.
api_method: POST
api_path: "/v1/users/me/cli-tokens/ephemeral"
canonical_url: https://wiblo.app/docs/developers/api/cli-tokens/mint-user-ephemeral
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/cli-tokens/mint-user-ephemeral.md
---

# Mint a short-lived user-scoped token

`POST /v1/users/me/cli-tokens/ephemeral`

Session-only. Mints a `cli_tokens.ephemeral` (`wbl_ephem_user_*`) with a 1h–24h TTL so an AI agent can act as the user before any workspace exists. The raw `access_token` is returned exactly once. Per-user rate-limited at 6 mints / hour. Out-of-range `ttl_seconds` is rejected at the schema layer as 400 `VALIDATION_FAILED` (the contract bounds it to 3600–86400).

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `ttl_seconds` | `integer` | Yes |  |
| `client_id` | `string` | No | Defaults to `"wiblo-cli"`. |
| `user_agent` | `string \| null` | No | Defaults to `null`. |
| `agent_label` | `string \| null` | No | Defaults to `null`. |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/users/me/cli-tokens/ephemeral \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "ttl_seconds": 0
}'
```

**TypeScript**

```ts
import { createSdk, mintUserEphemeral } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await mintUserEphemeral({
  client: sdk,
  body: {
    "ttl_seconds": 0
  },
})
```

## Responses

**`201`** — The ephemeral token was minted; `access_token` shown once. Returns `MintEphemeralCliTokenResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `access_token` | `string` | Yes |  |
| `id` | `string` | Yes |  |
| `kind` | `"ephemeral"` | Yes |  |
| `expires_at` | `string` | Yes |  |

**`400`** — Body failed Zod validation, including out-of-range `ttl_seconds` (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — A `wbl_*` bearer was presented to a session-only route (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.