Client tokens
Issue scoped tokens for browsers and mobile apps. Included with the services that use them. The base URL is https://www.motor.dev/meta, and the OpenAPI 3.1 specification describes each endpoint.
Sign in to try the API here with one of your team's keys. Requests use that key's permissions and spending limit. Standard charges apply.
Client tokens
Client tokens let browsers and mobile apps access a limited set of resources without receiving your secret API key. Your server authenticates the user, then calls POST /meta/client_tokens to issue a token for that subject, its attributes, and the permitted flags. The client cannot change these values. The only supported scope is currently feature_flags:evaluate.
First configure client access for the feature flag environment. Then issue a token with your server's secret key:
curl https://api.motor.dev/meta/client_tokens \
-H "Authorization: Bearer $MOTOR_KEY" -H "Idempotency-Key: $(uuidgen)" \
-d '{"subject": "user_123", "scopes": ["feature_flags:evaluate"], "expires_in": 900,
"feature_flags": {"environment_id": "ffe_...", "publishable_key_id": "key_...",
"flag_keys": ["new_checkout"], "attributes": {"plan": "pro"}}}'
Send the returned token in the client's Authorization header when evaluating flags. Publishable keys can issue anonymous tokens only. To revoke a token, call DELETE /meta/client_tokens/{token_id} with a permitted secret key or the token itself. Cache evaluation results separately for each credential, environment, and subject; clear them when the user signs out or the token changes.
Authentication and retries
Authenticate with Authorization: Bearer <credential>. POST requests that create or change resources require an Idempotency-Key. Retry a lost response with the same key, body, and headers to recover the original response for up to 35 days. For feature flags, omit Motor-Mode or set it to live; test is not supported. These APIs add no separate usage charge, but the underlying service's permissions and limits still apply.
Client tokens
Issue a client token
Issues a short-lived token that evaluates chosen client-visible flags for one subject in a browser or app. Your server authenticates the user first. A publishable key can issue only anonymous tokens. Credentials: a secret key, a publishable key.
Request body{
"subject": "user_123",
"scopes": [
"feature_flags:evaluate"
],
"expires_in": 900,
"feature_flags": {
"environment_id": "ffe_UJAs9eZep7hvba6xBh5dvY",
"publishable_key_id": "key_DuQaWzydzQjd8J84rbPfSd",
"flag_keys": [
"checkout"
],
"attributes": {
"plan": "pro"
}
}
}
Responses
201Success.
{
"id": "ct_RuAcjb8WxC7DHMftuaGCiz",
"token": "motor_ct_EXAMPLE_NOT_A_REAL_SECRET",
"subject": "user_123",
"expires_at": "2026-10-05T00:16:39Z"
}
DELETE/meta/client_tokens/{token_id}
Revoke a client token
Immediately revokes a client token. You can authenticate with the token itself to revoke it. Credentials: a secret key, a client token.
Responses
200Success.
{
"id": "ct_RuAcjb8WxC7DHMftuaGCiz",
"deleted": true
}