# 3pm-backend route `bucketToken`

Paths are relative to the backend's origin (https://fleet.edgecr4ft.net, or your own 3pm-backend), not to this site. Index: https://3pm.edgecr4ft.net/docs/backend/api.md

---

tokens:
  claude: 511
  o200k: 323
# GET /api/buckets/{clusterId}/enroll-token (bucketToken)

The bucket's permanent enrollment token and its paste line: the same at every read, never expiring, any number of hosts, not revocable. Created on the first read; its hosts wait for `approveNode` unless the bucket's `approval` is off.

- auth: an account — Authorization: Bearer 3pmu_<token>, or the dashboard's session cookie
- answer: BucketToken (JSON)

## Types

```ts
/** `bucketToken`: the bucket's permanent enrollment token — the only one whose secret can be read again. */
interface BucketToken {
  token_id: string;
  /** `3pmk_<id>.<secret>`: the same at every read. Whoever holds it enrolls hosts into the bucket, for as long as the bucket lives. */
  token: string;
  /** `3pm link <cluster> <token> <server>`, ready to paste or to hand to a provisioning script. */
  paste_line: string;
  /** `curl -fsSL …/install.sh | sh -s -- link <cluster> <token> <server>`: installs 3pm and links, for a host without 3pm. Re-run, it updates 3pm and keeps the link. */
  install_line: string;
  created_at: EpochMs;
}

/** Milliseconds since the Unix epoch. */
type EpochMs = number;
```