> ## Documentation Index > Fetch the complete documentation index at: https://felan.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Exchange a machine credential for a scoped host token > Resolves the personal host that browser pairing bound to this credential and installId; the exchange never creates personal hosts. Rechecks team membership, credential and host revocation, and schema support on every exchange. All responses use Cache-Control: no-store. The name is limited to 128 UTF-8 bytes. ## OpenAPI ````yaml /openapi/v1.json post /hosts/token openapi: 3.1.0 info: title: Felan API description: >- Team-scoped access to Felan sessions, members, invitations, integrations, environments, environment variables, automations, skills, custom subagents, and inbound events. version: 1.0.0 contact: name: Felan Support url: https://felan.ai servers: - url: https://app.felan.ai/api/v1 description: Production security: - bearerAuth: [] tags: - name: Hosts - name: Teams - name: Integrations - name: Environments - name: Environment Variables - name: Automations - name: Skills - name: Subagents - name: Sessions - name: Events - name: OpenAPI paths: /hosts/token: post: tags: - Hosts summary: Exchange a machine credential for a scoped host token description: >- Resolves the personal host that browser pairing bound to this credential and installId; the exchange never creates personal hosts. Rechecks team membership, credential and host revocation, and schema support on every exchange. All responses use Cache-Control: no-store. The name is limited to 128 UTF-8 bytes. operationId: exchangeHostToken requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HostTokenRequest' responses: '200': description: >- Scoped ES256 host token, valid for at most 15 minutes. Never cache this response. content: application/json: schema: $ref: '#/components/schemas/HostTokenResponse' '400': description: 'invalid_request: malformed JSON or invalid HostTokenRequest.' content: application/json: schema: $ref: '#/components/schemas/HostTokenError' '401': description: >- invalid_pat: missing, unknown or revoked (for a current member) credential, a non-personal credential, or a credential not paired with this installId. content: application/json: schema: $ref: '#/components/schemas/HostTokenError' '403': description: >- not_a_member: the credential owner left the team (including when the credential was revoked on departure); host_revoked: this machine was revoked. Pair it again through POST /hosts/pairings. content: application/json: schema: $ref: '#/components/schemas/HostTokenError' '426': description: >- unsupported_schema: protocol or row schema version is not supported; supported lists accepted versions. content: application/json: schema: $ref: '#/components/schemas/HostTokenError' '429': description: 'rate_limited: retry with backoff according to Retry-After.' headers: Retry-After: description: Seconds until the rate limit resets. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/HostTokenError' '500': description: 'internal_error: retry with backoff.' content: application/json: schema: $ref: '#/components/schemas/HostTokenError' security: - personalAccessToken: [] components: schemas: HostTokenRequest: type: object required: - installId - name - daemonVersion - protocol - rowSchemaVersion properties: installId: type: string pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ name: type: string minLength: 1 maxLength: 128 x-maxBytes: 128 daemonVersion: type: string minLength: 1 maxLength: 128 x-maxBytes: 128 protocol: type: number const: 1 rowSchemaVersion: type: integer minimum: 0 maximum: 9007199254740991 HostTokenResponse: type: object required: - token - expiresAt - refreshAt - host - supabase properties: token: type: string minLength: 1 expiresAt: type: integer minimum: 0 maximum: 9007199254740991 refreshAt: type: integer minimum: 0 maximum: 9007199254740991 host: type: object required: - id - teamId - userId properties: id: type: string pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ teamId: type: string pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ userId: type: string pattern: >- ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ supabase: type: object required: - url - publishableKey properties: url: type: string minLength: 1 maxLength: 2048 x-maxBytes: 2048 publishableKey: type: string minLength: 1 maxLength: 256 x-maxBytes: 256 HostTokenError: type: object required: - code - message properties: code: type: string minLength: 1 maxLength: 128 x-maxBytes: 128 message: type: string minLength: 0 maxLength: 4096 x-maxBytes: 4096 pattern: "^[^\0-\x1F\x7F-\x9F]*$" supported: type: object required: - protocol - rowSchemaVersion properties: protocol: type: array items: type: integer minimum: 0 maximum: 9007199254740991 rowSchemaVersion: type: array items: type: integer minimum: 0 maximum: 9007199254740991 securitySchemes: bearerAuth: type: http scheme: bearer description: Team API key. Current keys retain the bzy_team_ compatibility prefix. personalAccessToken: type: http scheme: bearer description: >- Machine credential (fln_pat_…) issued by browser pairing through POST /hosts/pairings/poll. Only accepted by the host token exchange. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.