MintTokenSource

MintTokenSource = string | ((request) => string | null | undefined | Promise<string | null | undefined>)

Defined in: fragments.ts:119

A signed mint token, or a function producing one.

The token is minted by the CUSTOMER’S BACKEND (POST https://app.sparkletree.io/api/embed/v1/fragments/mint-token with an org-pinned st_ key; this is the app host, not the embed apiBase, which does not serve this endpoint) and is bound to one (org, ctxhash, schemahash) for 300 seconds. The browser only echoes it. The callback form exists because of that TTL: a page open longer than five minutes needs a fresh token at mint time, not the one that shipped with the HTML.

The callback receives the write it is signing for — the same declared dims and normalized schema the mint POST carries, plus both hashes — because a token is bound to exactly one (contextHash, schemaHash). Forward context and schema to your backend’s mint-token call as-is; a page with several useFragments declarations gets a matching token for each. A callback that ignores its argument (the pre-0.11.2 form) still compiles and runs.