---
title: "Get Consumer App Portal Access"
method: POST
path: "/api/v1/auth/app-portal-access/{app_id}"
tags: ["Authentication"]
---

# Get Consumer App Portal Access

`POST /api/v1/auth/app-portal-access/{app_id}`

Use this function to get magic links (and authentication codes) for connecting your users to the Consumer Application Portal.

## Path parameters

- `app_id` string, required — The Application's ID or UID.

## Headers

- `idempotency-key` string

## Request body

- AppPortalAccessIn
  - `application` ApplicationIn
    - `name` string, required — Application name for human consumption.
    - `rateLimit` integer, nullable — Deprecated, use `throttleRate` instead.
    - `throttleRate` integer, nullable — Maximum messages per second to send to this application. Outgoing messages will be throttled to this rate.
    - `uid` string, nullable — Optional unique identifier for the application.
    - `metadata` object
  - `readOnly` boolean, nullable — Whether the app portal should be in read-only mode.
  - `capabilities` AppPortalCapability[], nullable — Custom capabilities attached to the token, You can combine as many capabilities as necessary. The `ViewBase` capability is always required - `ViewBase`: Basic read only permissions, does not allow the user to see the endpoint secret. - `ViewEndpointSecret`: Allows user to view the endpoint secret. - `ManageEndpointSecret`: Allows user to rotate and view the endpoint secret. - `ManageTransformations`: Allows user to modify the endpoint transformations. - `CreateAttempts`: Allows user to replay missing messages and send example messages. - `ManageEndpoint`: Allows user to read/modify any field or configuration of an endpoint (including secrets) By default, the token will get all capabilities if the capabilities are not explicitly specified.
  - `featureFlags` string[] — The set of feature flags the created token will have access to.
  - `expiry` integer, nullable — How long the token will be valid for, in seconds. Valid values are between 1 hour and 7 days. The default is 7 days.
  - `sessionId` string, nullable — An optional session ID to attach to the token. When expiring tokens with "Expire All", you can include the session ID to only expire tokens that were created with that session ID.

## Response `200`

- AppPortalAccessOut
  - `url` string, uri, required
  - `token` string, required

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `409` — Conflict
- `422` — Validation Error
- `429` — Too Many Requests

---

[API](https://skmtc.net/svix/apis/svix-api.md) · [All operations](https://skmtc.net/svix/apis/svix-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/svix/svix-api/revisions/16dbcc056c48/schema)