Generate a service access token
Create a short-lived JWT for accessing an HTTP service running on a specific port inside a sandbox. Returns a browser_url (sets auth cookie via redirect), an embed_url (for an iframe; carries the token in the URL fragment, so no server or Referer sees it), a service_url (for use with the X-Langsmith-Sandbox-Service-Token header), the raw token, and its expiry. Set access=restricted|workspace to instead enable durable LangSmith login (no token; users authenticate with their normal LangSmith session), or access=off to disable it. embed_origins names the pages that may show the URL in an iframe. In token mode they are bound into the minted token; with LangSmith login they are stored on the grant and a viewer signs in from inside the frame through a LangSmith popup. LangSmith login and token access are mutually exclusive per service URL.
Authorizations
Path Parameters
Sandbox display name
Body
Access selects the login mode, mutually exclusive with the minted token. Omit the field for token mode: mint a short-lived service token (default). "restricted" — LangSmith login: the sandbox's creator, or any user with SandboxesExec on it (admins by default). "workspace" — LangSmith login: any member of the owning workspace. "off" — remove an existing LangSmith login grant and mint a token. A LangSmith login grant is durable; token mode is refused (409) while one exists.
restricted, workspace, off EmbedOrigins are the pages allowed to show the service URL in an iframe, besides LangSmith itself: at most 5 origins such as https://app.example.com (http only for localhost). In token mode they are bound into the minted token, so they last as long as it does. With access "restricted" or "workspace" each call sets the grant's whole list, so omitting the field removes any origins set before.
Response
OK
Access echoes the enabled LangSmith login level ("restricted"/"workspace"); omitted in token mode.
restricted, workspace EmbedOrigins echoes the origins that may embed the URL, normalized; omitted when there are none.
EmbedURL opens the service in an iframe: the token rides the URL fragment, which no server, log or Referer header sees, and the page it loads trades it for the cookie. Append &redirect=/path to land elsewhere than /. Omitted in LangSmith login mode.
Token and ExpiresAt are empty in LangSmith login mode (no token is minted).