Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
Skip to Content
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceProvidersProvider

Generate a provisioning token (provider only)

Mints a provisioning token for enrolling nodes and returns its secret, shown only once. A persistent token enrolls any number of nodes for 24 hours. An interruptible token (class interruptible) lives 30 days and enrolls at most maxEnrollments nodes. A legacy API key needs clusters:write.

Required permission

Requires the provider.write permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl provider provisioning-token create
POST
/v1/orgs/{orgId}/provider/tokens

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

orgId*string

Request Body

application/json
  1. body

A persistent token (the default class) lives 24 hours from creation and enrolls any number of nodes in that window. An interruptible token lives 30 days and enrolls at most maxEnrollments nodes; each is a provider-owned container onboarded with the interruptible bootstrap. The node runtime is not a token property; each node detects its own shape at enroll. Expired and revoked tokens stay listed for 6 days after they expire, then fall out.

name?string
class?NodeClass

Node class. persistent: a provider host we schedule VMs or pods on (the default). interruptible: a provider-owned GPU container that can be reclaimed at any time, onboarded with the interruptible bootstrap.

Value in"persistent""interruptible"
noticeSeconds?integer

Interruptible only: the reclaim notice your market gives, in seconds. Default 30; 0 means none.

Range0 <= value <= 3600
maxEnrollments?integer

Interruptible only: the most nodes the token may enroll. Default 64.

Range1 <= value <= 1000

Response Body

Created

application/json
  1. response
id*string
token*string
tokenPrefix*string
name?string
expiresAt*string

24 hours after creation for a persistent token, 30 days for an interruptible one.

warning*string
nodePool?string
nodeType?string

Node class the token enrolls: persistent | interruptible.

noticeSeconds?integer

Interruptible tokens only.

maxEnrollments?integer

Interruptible tokens only.

Example Request
curl -X POST 'https://api.openrelay.inc/v1/orgs/string/provider/tokens' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "id": "string",  "token": "string",  "tokenPrefix": "string",  "name": "string",  "expiresAt": "string",  "warning": "string",  "nodePool": "string",  "nodeType": "string",  "noticeSeconds": 0,  "maxEnrollments": 0}

List provisioning tokens (provider only) GET

Returns the organization's provisioning tokens, newest first, with each token's prefix, class, status, expiry and enrollment count. The secret is never shown. A token that can still enroll is always listed. Expired, exhausted and revoked tokens stay listed until 6 days after they expire, then fall out.

Revoke a provisioning token DELETE

Revokes a provisioning token so it can no longer enroll nodes, and it stays listed as revoked. Nodes the token already enrolled keep running. A legacy API key needs clusters:write.