Mint a short-lived relay attach token (driver/viewer for users; host for the provisioning daemon) for an interactive session.

USER mint (role driver/viewer or omitted): authentication accepts a browser session or a WorkOS user token only; an rsk API key or a BYOA OAuth-agent token is rejected 403 (no user identity to derive a role from). The minted role is a server-derived ceiling, never a client-claimed value. HOST mint (role "host"): accepts ONLY a worker-class machine identity - a plain org rsk_ API key or a worker runtime JWT - acting within the session's org; human identities, OAuth-agent tokens, and registration-bound keys are rejected 403. The host response carries the daemon wire contract { attachUrl, token, epoch, expiresAt } with a freshly allocated host stream epoch. HOST refresh (role "host-refresh", requires epoch): same caller gate as "host"; re-signs a token for the CURRENT host generation WITHOUT allocating a new epoch - the reconnect-after-expiry re-mint rail. A presented epoch that no longer matches the live generation is refused 409 (epoch_stale).

curl -X POST "https://example.com/api/interactive-sessions/string/tokens" \  -H "Content-Type: application/json" \  -d '{}'

{
  "token": "string",
  "sseTicket": "string"
}