---
topic: claim
connector: "Not needed: connector deploys are already in the person's account"
api: "POST https://ship.embarko.ai/api/public/deploy-tokens/request, then redeploy"
needs_human: The person reads the token in their email and pastes it to you.
requires: [deploy]
---

[← Guide home](https://embarko.ai/docs)

# Keep a temporary app

**On this page:** Over HTTP, Examples, Limits, Errors, What to tell the person

> Plain words unless the person is a developer. Never invent a link, name or code. [Rules](https://embarko.ai/docs/prerequisites) Needs first: [deploy](https://embarko.ai/docs/deploy).

An app deployed over HTTP without a token is deleted 24 hours after its first deploy (the exact time is app.expiresAt). Claiming makes it permanent at the same link. Apps deployed through the connector are already permanent: skip this.

**Connector:** Not needed: connector deploys are already in the person's account

**Done when:** The deploy reply says claimed: true.

**Over HTTP**

1. Check for a token first: DEPLOY_TOKEN, then the first line of ~/.embarko/credentials. If one exists, skip to the redeploy.
2. Ask the person for their email, then POST https://ship.embarko.ai/api/public/deploy-tokens/request with {"email": "..."}. Call it once. It always answers 202; the token goes to their inbox, never to you.
3. Ask them to paste the token. Save it to ~/.embarko/credentials (mode 600) so you never ask again. Never repeat it back.
4. Redeploy to https://ship.embarko.ai/apps with the same X-App-Name and Authorization: Bearer {token}. The reply has app.claimed true.
5. From now on send the same token on status and logs: a claimed app answers 404 without it.

**Example: Request the token**

body.json:

```json
{"email":"person@example.com"}
```

```bash
curl -sS -X POST 'https://ship.embarko.ai/api/public/deploy-tokens/request' -H 'Content-Type: application/json' --data @body.json
```

Reply 202:

```json
{"message":"If this email address is valid, a deploy token for each of your workspaces has been sent to it. Check the inbox (and spam folder). Each request creates a new token; your existing tokens keep working."}
```

**Example: Redeploy with it → claimed**

```bash
curl -sS -X POST 'https://ship.embarko.ai/apps' --oauth2-bearer $DEPLOY_TOKEN -H 'X-App-Name: my-app' -H 'X-Agent-Name: codex' -F 'source=@/tmp/app.tar.gz'
```

Reply 202:

```json
{"success":true,"status":"building","app":{"name":"my-app","kind":"service","claimed":true},"next":"Claimed, so the app is permanent now. Building: poll links.status every 10 seconds until it says \"live\" or \"failed\".","links":{"status":"https://ship.embarko.ai/apps/my-app/status","feedback":"https://ship.embarko.ai/apps/my-app/customer-query"}}
```

**Limits**

- There is no reminder email. Tell the person the deletion time yourself.
- Token requests: 5 per email and 10 per IP per hour. The reply is 202 even when limited, so a retry tells you nothing.
- Tokens do not expire. Each request makes a new one; old ones keep working.

**Errors**

| Code | Status | Retry | What to do |
| --- | --- | --- | --- |
| `unauthorized` | 401 | No | The pasted token is wrong or revoked. Ask the person to check they copied all of it. |

**What to tell the person**

- offer: "Your app is live: {link}. It stays online until {time}. Want to keep it? Tell me your email and I'll set it up."
- ask_token: "I've sent a code to {email} (check spam too). Paste it here and your app becomes permanent."
- done: "Done: your app is permanent."

**Next:** Tell the person when the app will be deleted, then offer to keep it.

**Related:** [showcase](https://embarko.ai/docs/showcase) · [custom-domain](https://embarko.ai/docs/custom-domain) · [env-vars](https://embarko.ai/docs/env-vars)

---

[Guide home](https://embarko.ai/docs) · JSON: add .json