> ## Documentation Index > Fetch the complete documentation index at: https://docs.upsolve.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get Embed Token > Sign one of your users in to an Upsolve embed. Creates their organization (a project organization, found by `organization.externalId`) and the user (found by `user.externalId` within it) on first use, updates the properties you send for row-level security, and returns a project-user token for the iframe. Safe to call on every page load; replaces register-organization + register-user + user-token. ## OpenAPI ````yaml post /v1/api/projects/embed-token openapi: 3.1.0 info: title: Upsolve API version: 1.5.0 servers: - url: https://api.upsolve.ai security: [] tags: [] paths: /v1/api/projects/embed-token: post: summary: Get an embed token for one of your users description: >- Sign one of your users in to an Upsolve embed. Creates their organization (a project organization, found by `organization.externalId`) and the user (found by `user.externalId` within it) on first use, updates the properties you send for row-level security, and returns a project-user token for the iframe. Safe to call on every page load; replaces register-organization + register-user + user-token. operationId: PostV1ApiProjectsEmbedToken requestBody: description: POST /v1/api/projects/embed-token Request body content: application/json: schema: type: object properties: apiKey: type: string minLength: 1 description: >- Upsolve API key, generated under Account → Developer settings in the Upsolve Hub. Keys are user-scoped: pass organizationId alongside the key to select which org to act on. examples: - up_embed_************ organizationId: description: >- Your Upsolve organization's UUID — the org that owns the API key and project. This is NOT a project organization: do not pass a value registered via /projects/register-organization, and do not pass an `externalId` (only `projectOrganizationId` accepts those). Omit it when using an org-bound API key — the org is read from the key and any value sent here is ignored. Required only for user-scoped API keys (created under Account → Developer settings) and for the Supabase JWT path, where the org is ambiguous and membership is verified against it. examples: - 123e4567-e89b-12d3-a456-426614174000 type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ projectId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ description: >- The Upsolve project the user is signed into. Shown on a workspace's Deploy page. organization: type: object properties: externalId: type: string minLength: 1 maxLength: 255 description: >- Your own id for the customer (tenant) this user belongs to. The project organization is created on first use and found by this id afterwards; an organization registered earlier with the same `externalId` is the one used. name: description: >- Display name in the Upsolve Hub. A new organization without one is named after `externalId`; omitted later, the stored name is kept. type: string minLength: 1 properties: description: >- Organization-level properties, read by RLS as `{{organization.}}`. Merged: a key sent replaces its value, `null` removes it, a key left out is kept. type: object propertyNames: type: string additionalProperties: {} required: - externalId description: Your customer, as a project organization. user: type: object properties: externalId: type: string minLength: 1 maxLength: 255 description: >- Your own id for the user, e.g. their id in your auth provider, as-is. The project user is created on first use and found by this id within their organization afterwards; the same person in two organizations is two project users. name: description: >- Display name in the Upsolve Hub. A new user without one is named after `externalId`; omitted later, the stored name is kept. Two users may share a name. type: string minLength: 1 properties: description: >- User-level properties, read by RLS as `{{user.}}`. Merged: a key sent replaces its value, `null` removes it, a key left out is kept. type: object propertyNames: type: string additionalProperties: {} userRoleId: description: >- A project user role (`GET /v1/api/projects/{projectId}/user-roles`), which grants dashboard editing permissions. Set on every call that sends it; `null` removes the user's role; leaving it out keeps whatever they have. type: - string - 'null' format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ defaultUserRoleId: description: >- The role a NEW user gets when `userRoleId` is left out. Never applied to an existing user, so a role changed in the Hub survives later sign-ins. type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ required: - externalId description: The person signing in. expiration: type: string enum: - 5m - 15m - 30m - 1h - 2h - 6h - 12h - 24h - 7d description: >- How long the token lives: one of 5m, 15m, 30m, 1h, 2h, 6h, 12h, 24h, 7d. Defaults to 1h. required: - projectId - organization - user examples: example1: value: projectId: 123e4567-e89b-12d3-a456-426614174000 organization: externalId: acme name: Acme Inc properties: tenant_id: acme user: externalId: user-42 name: ada@acme.com properties: email: ada@acme.com region: EU expiration: 1h apiKey: up_embed_************ organizationId: 123e4567-e89b-12d3-a456-426614174000 required: true responses: '200': description: POST /v1/api/projects/embed-token Positive response content: application/json: schema: type: object properties: status: type: string const: success data: type: object properties: token: type: string description: >- The project-user JWT. Put it in the iframe src as `?jwt=`, or hand it over with `embed:set-token`. expiresAt: type: string description: When the token expires, as an ISO 8601 timestamp. projectUserId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ description: The project user the token speaks for. projectOrganizationId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ description: The project organization the user belongs to. userCreated: type: boolean description: Whether this call created the user. organizationCreated: type: boolean description: Whether this call created the organization. required: - token - expiresAt - projectUserId - projectOrganizationId - userCreated - organizationCreated additionalProperties: false required: - status - data additionalProperties: false '400': description: POST /v1/api/projects/embed-token Negative response content: application/json: schema: type: object properties: status: type: string const: error error: type: object properties: message: type: string code: type: string details: type: object propertyNames: type: string additionalProperties: {} required: - message additionalProperties: false required: - status - error additionalProperties: false security: - APIKEY_1: [] components: securitySchemes: APIKEY_1: type: apiKey in: query name: apiKey x-in-actual: body description: apiKey MUST be supplied within the request body instead of query ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.