Skip to main content
POST
/
api
/
sandboxes
/
{id}
/
preview
/
rotate
Rotate Preview-URL Auth Token
curl --request POST \
  --url https://app.opencomputer.dev/api/sandboxes/{id}/preview/rotate \
  --header 'X-API-Key: <api-key>'
{
  "previewAuthToken": "qx2sSi5IYXWBvnnRqwK9Ky_cIAI-x0Vx1bPCt0XMxsI",
  "scheme": "bearer"
}
Mint a new bearer token for the sandbox’s preview-URL auth gate. The old token stops working immediately — there is no zero-downtime dual-token mode, so roll the new token out to your caller before discarding the old one. If the sandbox was originally created without previewAuth, this call installs a token and starts enforcing the gate from that point on. The plaintext is returned exactly once in the response. Only the SHA-256 hash is persisted server-side; the server cannot show you the token again later.
​
id
string
required
Sandbox ID
{
  "previewAuthToken": "qx2sSi5IYXWBvnnRqwK9Ky_cIAI-x0Vx1bPCt0XMxsI",
  "scheme": "bearer"
}

​
Errors

StatusWhen
404Sandbox not found, or owned by a different org
410Sandbox is stopped or error
503Database not configured (combined-mode CP without PG)