Clerk API (unofficial showcase)
POST/admin_portal_link_tokens

Create an admin portal link token

Creates a single-use admin portal link token, optionally scoped to an organization and IT contact. Supply organization_id, it_contact_id, scopes, and seconds_until_expiration as needed; the expiration defaults to 3600 seconds. Treat the returned token as a secret because it is URL-borne.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

4 body fields

Admin portal link token settings. No individual body fields are marked as required.

organization_idstringoptional
The organization identifier to scope the token to, in the format `org_` followed by 27 word characters.
it_contact_idstringoptional
The opaque identifier for the IT contact associated with the link. Must contain at least one character.
scopesarray<string>optional
The scopes to assign to the token. Each scope must contain at least one character.
seconds_until_expirationintegeroptional
The token lifetime in seconds. Must be greater than 0 and at most 86400; defaults to 3600 when omitted.
Default:3600

5 status codes
201Returns the created admin portal link token object, including its identifier, scopes, expiration, and single-use token value. Treat the token value as a secret.
objectstringrequired
Allowed:admin_portal_link_token
idstringrequired
admin_portal_link_idstringrequired
The origin-level admin_portal_link this token was issued for.
instance_idstringrequired
organization_idstringrequired
Optional. Present only when the link is scoped to an existing org.
it_contact_idstringrequired
Optional opaque reference to the IT contact associated with this link.
scopesarray<string>required
Caller-provided scopes for this token.
tokenstringrequired
The single-use admin portal link token. Returned only on creation. URL-borne; treat as a secret.
revokedbooleanrequired
revocation_reasonstringrequired
expiredbooleanrequired
expirationnumberrequired
The timestamp for when the token will expire, in milliseconds.
created_atnumberrequired
The timestamp for when the token was created, in milliseconds.
updated_atnumberrequired
The timestamp for when the token was last updated, in milliseconds.
400Returned when the request is invalid.
errorsarray<object>required
401Returned when the request is unauthorized.
errorsarray<object>required
403Returned when the request is forbidden.
errorsarray<object>required
409Returned when the request conflicts with the current state.
errorsarray<object>required

Error handling

A 400 indicates invalid request data; a 401 indicates unauthorized access; a 403 indicates forbidden access; a 409 indicates a conflict. organization_id must match the org_ identifier format, it_contact_id and each scopes item must be non-empty, and seconds_until_expiration must be greater than 0 and no more than 86400.