> ## Documentation Index
> Fetch the complete documentation index at: https://docs.glider.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Dev Auth Token

> Internal-only endpoint for minting short-lived staging dev-auth tokens

This endpoint mints a short-lived signed dev-auth token for browser
development/testing against local or staging `platform-api` targets.

## Scope

* Internal-only
* Disabled for production use
* Protected by `ADMIN_AUTH_SECRET_TOKEN`

## Request

Headers:

* `Authorization: Bearer <ADMIN_AUTH_SECRET_TOKEN>`
* `Content-Type: application/json`

Body:

```json theme={null}
{
  "primaryWallet": "0x1000000000000000000000000000000000000001",
  "linkedWallets": [
    {
      "address": "11111111111111111111111111111111",
      "chainType": "solana",
      "vm": "solana"
    }
  ],
  "userId": "dev-user-1",
  "vmPreference": "evm",
  "expiresInSeconds": 900,
  "issuer": "webapp-v2-debug"
}
```

Fields:

* `primaryWallet`: required canonical wallet for the synthetic session
* `linkedWallets`: optional additional linked wallets
* `userId`: optional synthetic user id override
* `vmPreference`: optional preferred VM for wallet routing
* `expiresInSeconds`: optional TTL override
* `issuer`: optional issuer override

## Response

```json theme={null}
{
  "claims": {
    "exp": 1775748004,
    "iat": 1775747104,
    "iss": "webapp-v2-debug",
    "jti": "01KNSCD020RXBWYYCTWF085NMB",
    "linkedWallets": [
      {
        "address": "0x1000000000000000000000000000000000000001",
        "chainId": 8453,
        "chainType": "ethereum",
        "vm": "evm"
      }
    ],
    "primaryWallet": "0x1000000000000000000000000000000000000001",
    "typ": "dev-auth",
    "userId": "dev-user-1",
    "vmPreference": "evm"
  },
  "token": "<signed-token>"
}
```

Use the returned token as:

```http theme={null}
x-glider-dev-auth-token: <signed-token>
```

## Runtime Behavior

`platform-api` treats accepted dev-auth tokens as wallet-backed sessions for:

* owner reads
* wallet routing
* realtime subscription ticket issuance
* feature-flag lookups

The token is rejected when:

* the runtime is production
* `DEV_AUTH_TOKEN_SECRET` is unset
* the token is expired or malformed
* the wallet claims are invalid