User tokens

User tokens are short-lived API tokens minted by your backend that "act as" a specific end user inside the Relu iframe viewer. They let you give users access without forcing them to create a Relu account.

Creation

Create a user token via POST /connections/api-token. You must limit it to a set of resources (order IDs), a user token can only act on those specific orders, not on your full account.

POST https://api.automate.relu.ai/connections/api-token
{
  "name": "enduser-2026-04-21",
  "expires_delta": 3600,
  "resources": ["order:<order_id>"],
  "scopes": ["read:orders", "update:orders", "..."],
  "assume_user_email": "enduser@example.com"
}

Constraints

• expires_delta, lifetime in seconds. Max 24 hours (86400). Pick the shortest value that fits your flow.
• resources, required. Pin the token to specific orders (format: "order:<order_id>"). Without this, token creation fails.
• scopes, only the scopes on the allowed list below are accepted.
• assume_user_email, every action taken with this token is attributed to this user in audit logs.

Recommended scopes

Copy this list for a standard iframe+draft-order flow. Trim down to only what your use case needs:

read:users
update:users
read:implant-library
read:roles
read:organization-logo
read:orders
update:orders
delete:orders
create:input-files
read:input-files
update:input-files
delete:input-files
create:output-files
read:output-files
update:output-files
delete:output-files
create:comments
read:comments
update:comments
delete:comments
read:order-permissions
create:order-permissions
update:order-permissions
delete:order-permissions
read:presets
create:presets
update:presets
delete:presets

What a user token reaches

A user token works on its orders and on its user's own account, nothing else:

• Its orders: read, update, finalize a draft, recompute, comment, share, unlock exports, and delete.
• Files on its orders, and files it uploads itself. An upload made with the token can go only on one of its orders.
• Its user's profile, presets and export bundles, and shared catalogs such as services, roles and the implant library.

It cannot create orders, API keys or members, register a desktop, or read your other orders. create:orders is still accepted on a user token, but grants it nothing. A share link made with a user token expires when the token does.

Use it

Your frontend receives the token from your backend and passes it to createViewerHost:

const host = createViewerHost({
  auth: { type: 'apiToken', token: userToken },
  /* ... */
});

Refresh the token before handing it to the iframe, expires_delta is short by design, so a token minted long before page load may already be expired.