> ## Documentation Index > Fetch the complete documentation index at: https://docs.nvisy.com/llms.txt > Use this file to discover all available pages before exploring further. # Mint a desktop app token > Mints a long-lived native-app session token for the authenticated account, to be delivered to the desktop app via the given desktop deep-link. Requires an active browser session (the desktop login completes in the browser first). The `redirectUri` must be a configured desktop scheme. ## OpenAPI ````yaml /api-reference/openapi.json post /auth/desktop/token openapi: 3.1.0 info: title: Nvisy API summary: Document detection and redaction platform description: >- Nvisy provides intelligent detection of sensitive content in documents, redaction pipelines, and reviewer workflows. This API enables document upload, detection analysis, redaction, and collaborative review across your workspaces. termsOfService: https://nvisy.com/legal/terms-of-service contact: name: Nvisy Support url: https://nvisy.com email: hello@nvisy.com license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 version: 0.1.0 servers: [] security: [] tags: - name: Health description: Service health checks - name: Capabilities description: Read-only reference data describing this deployment - name: Accounts description: Account management and profile operations - name: Identities description: 'Account sign-in methods: password and linked providers' - name: Avatars description: Public avatar image serving - name: Authentication description: Login, signup, and token management - name: Workspaces description: Workspace creation and management - name: Activities description: Workspace activity log and export - name: Documents description: Document upload, download, and management - name: Analytics description: Aggregate metrics over a workspace's documents - name: Members description: Workspace member management - name: Invites description: Workspace invitation handling - name: API Tokens description: API token management - name: Connections description: External provider connections - name: Connection Syncs description: Connection synchronization runs - name: Providers description: Inference-provider configuration - name: Pipelines description: Redaction pipeline configuration - name: Detections description: Detection analysis and redaction - name: Redactions description: Redactions produced from a detection, with reviewer edits - name: Reviews description: Document reviews, the review queue, and their discussion - name: Policies description: Redaction policy configuration - name: Webhooks description: Webhook configuration - name: Notifications description: Account notification management paths: /auth/desktop/token: post: tags: - Authentication summary: Mint a desktop app token description: >- Mints a long-lived native-app session token for the authenticated account, to be delivered to the desktop app via the given desktop deep-link. Requires an active browser session (the desktop login completes in the browser first). The `redirectUri` must be a configured desktop scheme. requestBody: description: >- Request payload to mint a native-app (desktop) session token. Called by the frontend after a normal browser (cookie) login when the login was initiated by the desktop app: it exchanges the just-established session for a long-lived `app` token the frontend then hands to the app via the `redirectUri` deep-link. The `redirectUri` must be a registered desktop scheme (e.g. `nvisy://…`), so a token cannot be minted toward a web origin. content: application/json: schema: $ref: '#/components/schemas/DesktopTokenRequest' required: true responses: '200': description: >- The result of minting a native-app (desktop) session token. The frontend hands `apiToken` to the desktop app via the `redirectUri` deep-link (`{redirectUri}?token={apiToken}`); the app stores it and sends it as an `Authorization: Bearer` credential. Browser web sessions use cookies instead and return no token. content: application/json: schema: $ref: '#/components/schemas/AccountDesktopToken' '400': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '415': description: 'Expected request with `Content-Type: application/json`' content: text/plain: schema: type: string '422': description: Failed to deserialize the JSON body into the target type content: text/plain: schema: type: string security: - BearerAuth: [] components: schemas: DesktopTokenRequest: description: >- Request payload to mint a native-app (desktop) session token. Called by the frontend after a normal browser (cookie) login when the login was initiated by the desktop app: it exchanges the just-established session for a long-lived `app` token the frontend then hands to the app via the `redirectUri` deep-link. The `redirectUri` must be a registered desktop scheme (e.g. `nvisy://…`), so a token cannot be minted toward a web origin. type: object properties: redirectUri: description: >- The desktop deep-link the app will receive the token on. Must match a configured desktop redirect scheme. type: string maxLength: 2048 minLength: 1 required: - redirectUri AccountDesktopToken: description: >- The result of minting a native-app (desktop) session token. The frontend hands `apiToken` to the desktop app via the `redirectUri` deep-link (`{redirectUri}?token={apiToken}`); the app stores it and sends it as an `Authorization: Bearer` credential. Browser web sessions use cookies instead and return no token. type: object properties: apiToken: description: The signed `app` JWT to send as a Bearer token. type: string redirectUri: description: The desktop deep-link the token should be delivered on, echoed back. type: string required: - apiToken - redirectUri ErrorResponse: description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error type: object properties: message: description: User-friendly error message safe for client display. type: string name: description: The error name/type identifier. type: string required: - name - message ````