# /api/auth/token (dashboard)

Source-derived dashboard endpoint contract, authentication, request validation, responses, and errors.

Source: https://docs.minds.sh/docs/api/platform/reference/dashboard--api-auth-token



This is the **dashboard** service route. Its origin and authentication are described in [Platform API overview](/docs/api/platform) and [Authentication](/docs/api/platform/authentication). A path shared by another service is a different endpoint.

| Property                       | Contract                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------ |
| Methods                        | GET                                                                            |
| Path                           | `/api/auth/token`                                                              |
| Path parameters                | None                                                                           |
| Query parameters read in route | None read directly; schema validation below may define additional fields       |
| Headers read in route          | No additional direct header reads; authentication helpers may read credentials |

## Authentication and access [#authentication-and-access]

Dashboard session cookie through @repo/auth/server. Some auth-summary routes can redirect to sign-in; inspect the status branches below.

## Method behavior [#method-behavior]

The handler excerpt preserves field validation, response envelopes, cookie changes, and exception branches. Values returned by service helpers retain their named response type above; for passthrough routes, the upstream response is authoritative.

### GET [#get]

```typescript
export async function GET() {
  // Dev bypass: return a synthetic token when no auth backend is available
  if (process.env.NODE_ENV === 'development' && process.env.DEV_BYPASS_AUTH === '1') {
    return Response.json({ token: 'dev-bypass-token' });
  }

  const session = await getSession();

  if (!session?.accessToken) {
    return Response.json({ error: 'Not authenticated' }, { status: 401 });
  }

  return Response.json({ token: session.accessToken });
}
```

Source: `minds-ui/apps/app/app/api/auth/token/route.ts:12`.

## Response and error branches [#response-and-error-branches]

Literal HTTP statuses in the route: 401. Shared management error classes are defined in [Errors and responses](/docs/api/platform/errors).

```typescript
Response.json({ token: 'dev-bypass-token' })
```

Source: `minds-ui/apps/app/app/api/auth/token/route.ts:15`.

```typescript
Response.json({ error: 'Not authenticated' }, { status: 401 })
```

Source: `minds-ui/apps/app/app/api/auth/token/route.ts:21`.

```typescript
Response.json({ token: session.accessToken })
```

Source: `minds-ui/apps/app/app/api/auth/token/route.ts:24`.

## Evidence [#evidence]

Generated from the local source snapshot on 2026-09-12. This page documents implemented code and does not certify a deployed service, permissions configuration, or successful provider operation.

Source file: `minds-ui/apps/app/app/api/auth/token/route.ts`. SHA-256: `e69839b20bcd563de6731b34cecd6e691a5a1e61db1fcd66b99c1afe1a319fab`.